CVE-2026-6008 — Im Park Information Technology, Electronics, Press, Publishi Vulnerability

title: CVE-2026-6008 - DijiDemi Authorization Bypass Attempt
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-6008 by targeting the DijiDemi API endpoint for user management. The vulnerability allows authorization bypass through user-controlled keys, potentially enabling privilege abuse. This rule looks for specific POST requests to the user API that might indicate an attempt to manipulate the 'userId' parameter to gain unauthorized access.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6008/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/DijiDemi/api/v1/users'
      cs-method:
          - 'POST'
      sc-status:
          - '200'
      cs-uri-query|contains:
          - 'userId=' # This parameter is often manipulated in authorization bypass vulnerabilities
  selection_specific_exploit:
      cs-uri-query|contains:
          - 'userId=admin'
      condition: selection AND selection_specific_exploit
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse