Chatwiki
Monthly
Cross-tenant insecure direct object reference in ChatWiki 2.9.6 and earlier allows any authenticated tenant user to read another tenant's form filter rules and overwrite that tenant's filter sort order by supplying arbitrary or sequential form_id values to the form-filter management endpoints getFormFilterList, getFormFilterInfo and updateFormFilterSort. Exploitation requires a valid low-privilege ChatWiki account on a multi-tenant deployment (PR:L in the assessed vector), so the flaw is not reachable pre-authentication, and the impact is confined to form-filter configuration data rather than code execution or administrative takeover. No public exploit code identified at time of analysis, though a detailed third-party technical writeup and the vulnerable source code are publicly linked in the advisory references.
Cross-tenant insecure direct object reference in ChatWiki 2.9.6 and earlier allows any authenticated tenant user to read another tenant's form filter rules and overwrite that tenant's filter sort order by supplying arbitrary or sequential form_id values to the form-filter management endpoints getFormFilterList, getFormFilterInfo and updateFormFilterSort. Exploitation requires a valid low-privilege ChatWiki account on a multi-tenant deployment (PR:L in the assessed vector), so the flaw is not reachable pre-authentication, and the impact is confined to form-filter configuration data rather than code execution or administrative takeover. No public exploit code identified at time of analysis, though a detailed third-party technical writeup and the vulnerable source code are publicly linked in the advisory references.