CVE-2026-123782

CVSS 5.3 (medium) · published 2026-11-06

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.

Weakness: CWE-639

Source: NVD CVE-2026-123782

References

• https://github.com/zhimaAi/chatwiki
• https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L307-L352
• https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L385-L411
• https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322dd0881e1b8cfe85de337fdaf2b
• https://github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3
• https://github.com/zhimaAi/chatwiki/issues/182
• https://github.com/zhimaAi/chatwiki/releases/tag/v2.10.0
• https://hackmd.io/@hieund/chatwiki-form-field-cross-tenant-idor
• https://www.vulncheck.com/advisories/chatwiki-before-2.10.0-cross-tenant-idor-via-saveformfield-and-updateformrequired

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.