CVE-2026-123782 ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

EUVD-2026-118300

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...

CVE-2026-123782

ChatWiki versions prior to 2.10.0 are vulnerable to an insecure direct object reference (IDOR) within the SaveFormField and UpdateFormRequired functions. This vulnerability allows authenticated users to modify form fields belonging to other tenants by providing their own form_id to pass ownership...

CVE-2026-123782: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and…

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential...