Read the docs
TI-2026-85962 Aliases CVE-2026-123782GHSA-7pjf-qfpr-qf9x

Cross-tenant form field modification in ChatWiki via IDOR

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ChatWiki before 2.10.0 contains an insecure direct object reference in SaveFormField and UpdateFormRequired. An authenticated user can modify form fields that belong to other tenants by pairing their own form_id with another tenant's sequential form_field id. The attacker can change field names, descriptions, types and required flags, which disrupts how submitted entries are stored. The flaw is tracked as CWE-639.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.

Why it matters now

EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed chatwiki (zhimaAi): 2.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
zhimaAichatwikibefore 2.10.02.10.0Patch availableCNA
  • chatwiki VendorzhimaAi Affected before 2.10.0 Fixed in 2.10.0 Patch available CNA

Remediation

Upgrade zhimaAi ChatWiki to version 2.10.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA chatwiki (zhimaAi) Fixed in 2.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zhimaAi chatwiki 2.10.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-85961 Cross-tenant fast command modification in ChatWikiPriority MEDIUM 57
    • TI-2026-86087 Missing authentication in ChatWiki exposes other tenants' documentsPriority LOW 38
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123782
  2. 2026-11-06 Alias added: GHSA-7pjf-qfpr-qf9x

References

Patch 2

Other 6

  • TI-2026-85961 Cross-tenant fast command modification in ChatWiki CVSS 4.0MEDIUM 5.3
  • TI-2026-86087 Missing authentication in ChatWiki exposes other tenants' documents CVSS 4.0HIGH 8.7
  • TI-2026-75442 Cross-tenant IDOR in ChatWiki exposes other tenants' form filters CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences