Read the docs
TI-2026-85961 Aliases CVE-2026-123624GHSA-x63m-gw63-246j

Cross-tenant fast command modification in ChatWiki

Priority MEDIUM 57CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ChatWiki before 2.10.0 by zhimaAi contains an insecure direct object reference that lets authenticated users modify other tenants' fast commands. By supplying arbitrary sequential ids to the saveFastCommand endpoint, an attacker with low privileges can overwrite another tenant's command title, type, content and robot binding. This can redirect webpage-jump commands to attacker URLs and reassign the record to the attacker's own tenant.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed chatwiki (zhimaAi): 2.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zhimaAichatwikibefore 2.10.02.10.0Patch availableCNA
  • chatwiki VendorzhimaAi Affected before 2.10.0 Fixed in 2.10.0 Patch available CNA

Remediation

Upgrade zhimaAi ChatWiki to version 2.10.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA chatwiki (zhimaAi) Fixed in 2.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zhimaAi chatwiki 2.10.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-86087 Missing authentication in ChatWiki exposes other tenants' documentsPriority LOW 38
    • TI-2026-85962 Cross-tenant form field modification in ChatWiki via IDORPriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123624
  2. 2026-11-06 Alias added: GHSA-x63m-gw63-246j
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 2

Other 5

  • TI-2026-86087 Missing authentication in ChatWiki exposes other tenants' documents CVSS 4.0HIGH 8.7
  • TI-2026-85962 Cross-tenant form field modification in ChatWiki via IDOR CVSS 4.0MEDIUM 5.3
  • TI-2026-75442 Cross-tenant IDOR in ChatWiki exposes other tenants' form filters CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences