CVE-2026-82816CWE-285CWE-639

CVE-2026-82816

Medium · published August 31, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00365 · 29.1th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-31T22:17Z
References (5)
https://drive.google.com/file/d/1-q66DxWFxQNmYF-1lzkHOodibWmZlGA0/view?usp=sharing · [email protected]https://vuldb.com/cve/CVE-2026-82816 · [email protected]https://vuldb.com/submit/876017 · [email protected]https://vuldb.com/vuln/397233 · [email protected]https://vuldb.com/vuln/397233/cti · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 31 AUG 17:45Z
    dibo-software diboot AI Session Endpoint ai-session authorization
    cvelistv5