{"id":"CVE-2026-111656","title":"ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints","summary":"ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"zhimaAi","product":"chatwiki","affected":["chatwiki <= 2.9.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T19:34:05.599637Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T21:18:25.806Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111656","references":[{"url":"https://hackmd.io/@hieuPenguinnn/chatwiki-form-filter-cross-tenant-idor"},{"url":"https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L878-L990"},{"url":"https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L1192-L1242"},{"url":"https://www.vulncheck.com/advisories/chatwiki-through-2.9.6-cross-tenant-idor-via-form-filter-management-endpoints","label":"VulnCheck Advisory: ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.674Z","slug":"CVE-2026-111656","body":"## Overview\n\nChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.\n\n## Affected\n\n- `chatwiki <= 2.9.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}