Read the docs
TI-2026-86087 Aliases CVE-2026-124027GHSA-qv5c-8hf7-xgx8

Missing authentication in ChatWiki exposes other tenants' documents

Priority LOW 38CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

ChatWiki before 2.10.0 by zhimaAi contains a missing authentication flaw (CWE-306) in the GET /manage/getLibRawFileOnePage route. An unauthenticated remote attacker can read other tenants' knowledge-base documents by enumerating sequential admin_user_id and file id values, which returns PDF-rendered pages of those documents.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.

Why it matters now

EPSS 0.00491 42nd percentileScored 2026-11-07
Fix Fixed chatwiki (zhimaAi): 2.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
zhimaAichatwikibefore 2.10.02.10.0Patch availableCNA
  • chatwiki VendorzhimaAi Affected before 2.10.0 Fixed in 2.10.0 Patch available CNA

Remediation

Upgrade zhimaAi ChatWiki to version 2.10.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA chatwiki (zhimaAi) Fixed in 2.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zhimaAi chatwiki 2.10.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-85961 Cross-tenant fast command modification in ChatWikiPriority MEDIUM 57
    • TI-2026-85962 Cross-tenant form field modification in ChatWiki via IDORPriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-124027
  2. 2026-11-06 Alias added: GHSA-qv5c-8hf7-xgx8
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2026-85961 Cross-tenant fast command modification in ChatWiki CVSS 4.0MEDIUM 5.3
  • TI-2026-85962 Cross-tenant form field modification in ChatWiki via IDOR CVSS 4.0MEDIUM 5.3
  • TI-2026-75442 Cross-tenant IDOR in ChatWiki exposes other tenants' form filters CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences