Vulnerability · Published Aug 31, 2026 · Assigned by VulDB
CVE-2026-82816dibo-software diboot AI Session Endpoint ai-session authorization
Medium 6.3
In plain English
A medium-severity authorization bypass via user-controlled key in diboot from dibo-software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dibo-software | diboot | 3.8.0 |
Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-397233 | dibo-software diboot AI Session Endpoint ai-session authorization vdb-entry
- VDB-397233 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-82816 | CVE Analysis and Report third-party-advisory
- Submit #876017 | dibo-software diboot v3.8.0 Insecure Direct Object Reference third-party-advisory
- https://drive.google.com/file/d/1-q66DxWFxQNmYF-1lzkHOodibWmZlGA0/view?usp=sharing exploit