CVE-2026-123624

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and...

CVE-2026-123782 ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

EUVD-2026-118300

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

CVE-2026-123782

ChatWiki versions prior to 2.10.0 are vulnerable to an insecure direct object reference (IDOR) within the SaveFormField and UpdateFormRequired functions. This vulnerability allows authenticated users to modify form fields belonging to other tenants by providing their own form_id to pass ownership...

CVE-2026-123624 ChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and...

CVE-2026-123624

ChatWiki versions prior to 2.10.0 are susceptible to an insecure direct object reference (IDOR) vulnerability. This flaw allows authenticated users to modify fast commands belonging to other tenants by providing arbitrary sequential IDs to the POST /manage/saveFastCommand endpoint. An attacker ca...

EUVD-2026-118299

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and...

CVE-2026-123782: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and…

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

CVE-2026-123624: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to…

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and...

CVE-2026-111656

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656 ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656 ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656

ChatWiki versions through 2.9.6 are vulnerable to a Cross-Tenant IDOR (Insecure Direct Object Reference) vulnerability within the form filter management endpoints. By supplying arbitrary form_id values, authenticated users can access data belonging to other tenants. Specifically, an attacker can ...

EUVD-2026-103078

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

PT-2026-116055

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form id values. Attackers can send sequential form id values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656: Authorization Bypass Through User-Controlled Key

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

ZhimaAi ChatWiki authorization issue vulnerability

zhimaAi chatwiki versions 2.9.6 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references, which may allow authenticated users to access other tenants’ form filters by providing arbitrary formid values. This could result in reading filt...