CVE-2026-111656: ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary formid values. Attackers can send sequential formid values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated as a ChatWiki user. The vulnerable endpoints accept arbitrary form_id values, allowing a user in one tenant to target form filters belonging to another tenant.
What can an attacker do with another tenant's form_id?
They can use getFormFilterList and getFormFilterInfo to read another tenant's filter rules. They can also use updateFormFilterSort to overwrite the targeted tenant's filter sort order.
How might an attacker find target form IDs?
The issue description states that attackers can send sequential form_id values. This indicates that enumerating form IDs can expose filters associated with other tenants.