EUVD-2026-103078
GHSA-wqfw-mf45-5858
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant user
-
ExploitEnumerate sequential form_id values
-
ExecutionCall getFormFilterList and getFormFilterInfo
-
ImpactRead and overwrite another tenant's filter rules
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated ChatWiki account (any low-privilege tenant user) on a multi-tenant deployment running version 2.9.6 or earlier; the attacker reaches the manage/form endpoints getFormFilterList, getFormFilterInfo and updateFormFilterSort and supplies arbitrary/sequential form_id values that are not scoped to the caller's tenant. Limiting factors: valid credentials are mandatory (PR:L, so not exploitable pre-authentication), impact is confined to form-filter rules (read) and filter sort order (overwrite) with no broader data or system compromise, and the cross-tenant exposure is only meaningful in multi-tenant/hosted configurations. |
| Impact | This is a medium-severity cross-tenant IDOR (CWE-639) with signals that point to a contained, authorization-layer problem rather than an urgent priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only Low confidentiality and Low integrity impact with no availability or subsequent-system effect. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the referenced hackmd and VulnCheck writeups are technical disclosures, not a confirmed weaponized POC). There is no SSVC decision data in the input. The signals do not conflict - a genuinely authenticated, low-impact data-exposure/tampering flaw in a niche product - so this reads as a real but low-urgency issue: prioritize patching for multi-tenant SaaS operators of ChatWiki, but it does not warrant emergency response. EPSS is absent rather than low; treat the lack of exploitation probability as missing data, not as a confirmed low score. |
| Exploit ScenarioDerived | An attacker registers or already holds a low-privilege account on one tenant of a multi-tenant ChatWiki instance (<=2.9.6). They iterate sequential form_id values against getFormFilterList and getFormFilterInfo to read other tenants' form filter rules, then call updateFormFilterSort to overwrite another tenant's filter sort order. No public weaponized exploit is identified, though the referenced hackmd writeup documents the exact vulnerable endpoints and source lines. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Cross-tenant insecure direct object reference in ChatWiki 2.9.6 and earlier allows any authenticated tenant user to read another tenant's form filter rules and overwrite that tenant's filter sort order by supplying arbitrary or sequential form_id values to the form-filter management endpoints getFormFilterList, getFormFilterInfo and updateFormFilterSort. Exploitation requires a valid low-privilege ChatWiki account on a multi-tenant deployment (PR:L in the assessed vector), so the flaw is not reachable pre-authentication, and the impact is confined to form-filter configuration data rather than code execution or administrative takeover. No public exploit code identified at time of analysis, though a detailed third-party technical writeup and the vulnerable source code are publicly linked in the advisory references.
RemediationAI
No vendor-released patch identified at time of analysis, and the public references point only at the vulnerable v2.9.6 source, so the primary fix is a server-side authorization change: every read or write of a form filter must resolve the supplied form_id inside the authenticated caller's tenant scope (join/filter on the caller's tenant_id) before returning or mutating data in getFormFilterList, getFormFilterInfo and updateFormFilterSort, applied at the manage/form.go business layer where the check is currently missing. Until a patched build is available, compensating controls with their trade-offs are: restrict the form-filter management endpoints to a trusted tenant/admin role, or disable the form-filter management feature entirely if your deployment does not use it (removes exposure but removes legitimate filter functionality); on self-hosted deployments, split tenants into separate ChatWiki instances and databases so a cross-tenant object reference cannot resolve to another tenant's records (effective, but increases hosting and maintenance cost); place an authenticating reverse proxy or gateway rule in front of the manage endpoints to log and rate-limit access and to alert on out-of-tenant or rapid sequential form_id patterns (detection-only, and can be evaded by an attacker who varies or spaces IDs); and monitor application/audit logs for one tenant reading or reordering another tenant's form filters, treating any confirmed access as a data exposure event. Track the VulnCheck advisory (https://www.vulncheck.com/advisories/chatwiki-through-2.9.6-cross-tenant-idor-via-form-filter-management-endpoints) and the upstream repository (https://github.com/zhimaAi/chatwiki) for a patched release, and re-test tenant isolation after upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-639 authorization bypass through a user-controlled key in the Go-based ChatWiki application, a multi-tenant chat/AI knowledge-base platform published by zhimaai (CPE cpe:2.3:a:zhimaai:chatwiki:*). The root cause is an object lookup keyed on a client-supplied identifier: the manage-layer handlers in internal/app/chatwiki/business/manage/form.go (notably the ranges at lines 878-990 and 1192-1242 in the v2.9.6 tree) fetch and mutate form-filter records using the form_id supplied by the caller without verifying that the record belongs to the caller's tenant, which is the classic IDOR pattern. Because form_id values are sequential, an authenticated user in one tenant can enumerate IDs belonging to another tenant, read their filter rules via the list/info endpoints, and tamper with ordering through updateFormFilterSort. The affected surface is the tenant-isolation/authorization layer rather than memory safety or injection; there is no evidence of privilege escalation beyond the tenant boundary or of system-level compromise, and the exposure is only meaningful on deployments where multiple tenants share the same ChatWiki instance and database. The 4.0 CVSS vector shows PR:L/VC:L/VI:L with availability and scope unchanged, consistent with the independent CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N assessment: an authenticated, low-impact cross-tenant integrity and confidentiality problem in a business-logic handler.
Know when Chatwiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user over the network (PR:L, AV:N, AC:L); low confidentiality from reading filter rules and low integrity from overwriting sort order, no availability impact, scope unchanged within the app.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB