Insecure Direct Object Reference in ChatWiki Affects Tenant Privacy
CVE-2026-123782

5.3MEDIUM

Key Information:

Vendor

Zhimaai

Status
Chatwiki
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123782?

ChatWiki versions prior to 2.10.0 are affected by an insecure direct object reference vulnerability. This flaw exists in the SaveFormField and UpdateFormRequired functionalities, allowing authenticated users to bypass ownership checks. By manipulating the form_id and sequential form_field id, attackers can alter attributes of form fields belonging to other tenants. This risk not only disrupts the integrity of the stored data but also poses a threat to tenant privacy, making it crucial for users to update to the latest version to mitigate this issue. For further details, refer to the patches linked in the release notes and advisory.

Affected Version(s)

chatwiki 0 < 2.10.0

References

https://github.com/zhimaAi/chatwiki/issues/182
issue-tracking
https://github.com/zhimaAi/chatwiki
product
https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HieuPenguinnn
hu19941107
.