Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-124027

ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zhimaai
Products
Chatwiki
CVE-2026-123782

ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhimaai
Products
Chatwiki
CVE-2026-123624

ChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhimaai
Products
Chatwiki
CVE-2026-111656

ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhimaai
Products
Chatwiki