CVE-2026-111656

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

EUVD-2026-103078

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656 ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and...

CVE-2026-111656

ChatWiki versions through 2.9.6 are vulnerable to a Cross-Tenant IDOR (Insecure Direct Object Reference) vulnerability within the form filter management endpoints. By supplying arbitrary form_id values, authenticated users can access data belonging to other tenants. Specifically, an attacker can ...

PT-2026-116055

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form id values. Attackers can send sequential form id values to getFormFilterList, getFormFilterInfo and...