CVE-2026-123782: ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

Published Nov 6, 2026

Updated

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own formid to satisfy the ownership check alongside another tenant's sequential formfield id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ChatWiki to a version that resolves this vulnerability.
Fixed in 2.10.0

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated ChatWiki user can exploit it. The attacker needs a form they own to pass the ownership check and a sequential form_field ID belonging to another tenant.

What can an attacker change in another tenant's form fields?

An attacker can alter field names, descriptions, types, and required flags through the SaveFormField and UpdateFormRequired functionality. This can disrupt how the affected tenant's submitted entries are stored.

Which deployments are affected?

ChatWiki versions before 2.10.0 are affected. The provided information does not identify any configuration prerequisite beyond having authenticated users and accessible form functionality.

How can I determine whether a form field has been targeted?

Review form fields for unexpected changes to their names, descriptions, types, or required status, particularly changes that alter submitted-entry storage behavior. The issue relies on cross-tenant use of sequential form_field IDs while supplying a form_id owned by the attacker.

CVE-2026-123782: ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change in another tenant's form fields?

Which deployments are affected?

How can I determine whether a form field has been targeted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change in another tenant's form fields?

Which deployments are affected?

How can I determine whether a form field has been targeted?