CVE-2026-123782
ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.
| CWE | CWE-639 |
| Vendor | zhimaai |
| Product | chatwiki |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for zhimaai chatwiki
Be the first to know when new medium vulnerabilities affecting zhimaai chatwiki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
zhimaAi / chatwiki
0 < 2.10.0
References
github.com: https://github.com/zhimaAi/chatwiki/issues/182 github.com: https://github.com/zhimaAi/chatwiki github.com: https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322dd0881e1b8cfe85de337fdaf2b github.com: https://github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3 github.com: https://github.com/zhimaAi/chatwiki/releases/tag/v2.10.0 github.com: https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L307-L352 github.com: https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L385-L411 hackmd.io: https://hackmd.io/@hieund/chatwiki-form-field-cross-tenant-idor vulncheck.com: https://www.vulncheck.com/advisories/chatwiki-before-2.10.0-cross-tenant-idor-via-saveformfield-and-updateformrequired
Credits
HieuPenguinnn hu19941107