CVE-2026-111656
Received Received - Intake

Insecure Direct Object Reference in ChatWiki

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111656
EUVD
EUVD-2026-103078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zhimaAi chatwiki 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ChatWiki through version 2.9.6 has an insecure direct object reference (IDOR) vulnerability. Authenticated users can access or modify another tenant's form filters by providing arbitrary form_id values. This allows reading filter rules and changing sort orders via specific endpoints like getFormFilterList, getFormFilterInfo, and updateFormFilterSort.

Detection Guidance

To detect this IDOR vulnerability in ChatWiki, inspect network traffic for requests to endpoints like getFormFilterList, getFormFilterInfo, and updateFormFilterSort. Check if the application processes arbitrary form_id values without proper tenant ownership validation. Look for sequential form_id enumeration attempts in logs.

Impact Analysis

This vulnerability allows attackers to view another tenant's filter configurations, including names, conditions, and field references. It also enables unauthorized modification of filter sort orders. The attack requires only a valid account in any tenant and does not expose form entry PII or bypass authentication.

Compliance Impact

This vulnerability could lead to compliance violations by exposing sensitive data across tenants, potentially violating confidentiality requirements in GDPR and HIPAA. Unauthorized data access and modification may result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately update ChatWiki to the latest version beyond 2.9.6. Implement tenant ownership checks in getFormFilterList, getFormFilterInfo, and updateFormFilterSort handlers by verifying admin_user_id matches the caller's tenant. Review form_filter and form_filter_condition tables to ensure tenant data segregation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart