CVE-2026-123624: ChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ChatWiki user can exploit it. The attacker needs to send a POST request to /manage/saveFastCommand with an arbitrary sequential fast-command ID belonging to another tenant.
What can an attacker change through the vulnerable endpoint?
The attacker can overwrite another tenant's fast-command title, type, content, and robot binding. They can also redirect webpage-jump commands to attacker-controlled URLs and reassign the affected record to their own tenant.
Which versions are affected?
ChatWiki versions before 2.10.0 are affected. Updating to 2.10.0 or later addresses the stated affected-version range.