Cross-Site Request Forgery Vulnerability in Wimi Teamwork by Wimi

CVE-2025-34133

What is CVE-2025-34133?

Wimi Teamwork, prior to version 7.38.17, is susceptible to a cross-site request forgery vulnerability within its API. This flaw allows attackers to bypass the verification process of the 'csrf_token' JSON field, as the API only checks for the presence of the token rather than its validity. As a result, an attacker can forge a request that exploits the privileges of a logged-in user, enabling potential account takeovers, privilege escalations, or service disruptions through unauthorized actions performed using the victim's session.

References