Executive Summary

CVE-2026-35023 is an Insecure Direct Object Reference (IDOR) vulnerability found in Wimi Teamwork On-Premises versions prior to 8.2.0. It exists in the preview.php endpoint where the item_id parameter lacks proper authorization checks.

Because of this flaw, attackers can enumerate sequential item_id values to access image previews that belong to other users' private or group conversations without permission.

This results in unauthorized disclosure of sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with limited privileges to access image previews from other users' private or group conversations without authorization.

As a result, sensitive information contained in these images can be exposed to unauthorized parties.

This unauthorized disclosure can lead to privacy breaches and potential misuse of confidential data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the preview.php endpoint for insecure direct object references in the item_id parameter. Specifically, you can attempt to enumerate sequential item_id values to see if you can access image previews from other users' private or group conversations without proper authorization.

A practical approach is to use command-line tools like curl or wget to send HTTP requests with different item_id values and observe if unauthorized data is returned.

• Example curl command to test item_id enumeration: curl -i -X GET "http://<target>/preview.php?item_id=1"
• Increment the item_id parameter in subsequent requests (e.g., item_id=2, item_id=3, etc.) to check if unauthorized previews are accessible.

Monitoring network traffic for unusual access patterns to preview.php with sequential item_id values may also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wimi Teamwork On-Premises to version 8.2.0 or later, where this insecure direct object reference vulnerability has been fixed.

Until the upgrade can be applied, restrict access to the preview.php endpoint to trusted users only, and monitor for suspicious activity involving the item_id parameter.

Implement additional authorization checks on the server side to ensure that users can only access previews associated with their own private or group conversations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized access to image previews from other users' private or group conversations, resulting in the disclosure of sensitive information.

Such unauthorized disclosure of sensitive information could potentially lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require proper protection of personal and sensitive data.

Useful 0 Not Useful 0