Is there a patch available for CVE-2026-35023?

Yes, a patch is available for CVE-2026-35023. Update the affected software to the latest version immediately.

PHP CVE-2026-35023

Q: What is the CVSS score of CVE-2026-35023?

CVE-2026-35023 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20472 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-08 VulnCheck

Authentication Bypass PHP

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 14:16 euvd

EUVD-2026-20472

Analysis Generated

Apr 08, 2026 - 14:16 vuln.today

Patch released

Apr 08, 2026 - 14:16 nvd

Patch available

CVE Published

Apr 08, 2026 - 12:59 nvd

MEDIUM 5.3

DescriptionCVE.org

Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id parameter lacks proper authorization checks. Attackers can enumerate sequential item_id values to access and retrieve image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information.

AnalysisAI

Wimi Teamwork On-Premises versions before 8.2.0 allow authenticated attackers to enumerate sequential item_id values in the preview.php endpoint to bypass authorization checks and access image previews from other users' private or group conversations, resulting in unauthorized information disclosure. The vulnerability requires valid user credentials (CVSS PR:L) but enables horizontal privilege escalation to retrieve sensitive conversation data. No public exploit code has been identified, though the IDOR vulnerability pattern is straightforward to exploit.

Technical ContextAI

This is an insecure direct object reference (IDOR) vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Wimi Teamwork On-Premises is a PHP-based collaboration platform that stores conversation metadata and image previews indexed by sequential item_id identifiers. The preview.php endpoint fails to validate whether the requesting user has authorization to access the specific item_id before returning preview data. Because item_id values are predictable integers, attackers with valid credentials can perform enumeration attacks by iterating through sequential values to discover and retrieve previews belonging to other users' conversations, effectively bypassing the authorization model that should isolate conversation data by user or group membership.

RemediationAI

Upgrade Wimi Teamwork On-Premises to version 8.2.0 or later, which contains authorization control fixes for the preview.php endpoint. Organizations unable to upgrade immediately should implement network segmentation to restrict access to preview.php to trusted internal users only, and audit conversation preview access logs for unauthorized enumeration patterns. The vendor advisory is available at https://www.wimi-teamwork.com/en/product-update.