CVE-2026-111656 — ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary …
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7