CVE-2026-35023
Insecure Direct Object Reference in Wimi Teamwork Preview.php Exposes Images
Publication date: 2026-04-08
Last updated on: 2026-04-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wimi | teamwork_on_premises | to 8.2.0 (exc) |
| wimi | teamwork_on-premises | to 8.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35023 is an Insecure Direct Object Reference (IDOR) vulnerability found in Wimi Teamwork On-Premises versions prior to 8.2.0. It exists in the preview.php endpoint where the item_id parameter lacks proper authorization checks.
Because of this flaw, attackers can enumerate sequential item_id values to access image previews that belong to other users' private or group conversations without permission.
This results in unauthorized disclosure of sensitive information.
How can this vulnerability impact me? :
This vulnerability allows attackers with limited privileges to access image previews from other users' private or group conversations without authorization.
As a result, sensitive information contained in these images can be exposed to unauthorized parties.
This unauthorized disclosure can lead to privacy breaches and potential misuse of confidential data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the preview.php endpoint for insecure direct object references in the item_id parameter. Specifically, you can attempt to enumerate sequential item_id values to see if you can access image previews from other users' private or group conversations without proper authorization.
A practical approach is to use command-line tools like curl or wget to send HTTP requests with different item_id values and observe if unauthorized data is returned.
- Example curl command to test item_id enumeration: curl -i -X GET "http://<target>/preview.php?item_id=1"
- Increment the item_id parameter in subsequent requests (e.g., item_id=2, item_id=3, etc.) to check if unauthorized previews are accessible.
Monitoring network traffic for unusual access patterns to preview.php with sequential item_id values may also help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Wimi Teamwork On-Premises to version 8.2.0 or later, where this insecure direct object reference vulnerability has been fixed.
Until the upgrade can be applied, restrict access to the preview.php endpoint to trusted users only, and monitor for suspicious activity involving the item_id parameter.
Implement additional authorization checks on the server side to ensure that users can only access previews associated with their own private or group conversations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized access to image previews from other users' private or group conversations, resulting in the disclosure of sensitive information.
Such unauthorized disclosure of sensitive information could potentially lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require proper protection of personal and sensitive data.