Insecure Direct Object Reference in ChatWiki Affects Multiple Tenants
CVE-2026-123624

5.3MEDIUM

Key Information:

Vendor

Zhimaai

Status
Chatwiki
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123624?

ChatWiki prior to version 2.10.0 is susceptible to an insecure direct object reference scenario that enables authenticated users to manipulate fast commands across different tenants. By submitting arbitrary sequential IDs to the POST /manage/saveFastCommand endpoint, attackers can overwrite command parameters, altering titles, types, and contents. This flaw can potentially redirect webpage-jump commands to malicious URLs and reassign commands to unauthorized tenants, compromising security across the application.

Affected Version(s)

chatwiki 0 < 2.10.0

References

https://github.com/zhimaAi/chatwiki/issues/180
issue-tracking
https://github.com/zhimaAi/chatwiki
product
https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HieuPenguinnn
hu19941107
.