{"id":"CVE-2026-123782","kind":"vulnerability","aliases":["CVE-2026-123782"],"related":[],"title":"ChatWiki: flaw lets one tenant edit another tenant's form fields","description":"ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.","summary":"ChatWiki before 2.10.0 fails to check that a form field belongs to the caller's tenant in SaveFormField and UpdateFormRequired. An authenticated user can change another tenant's field names, descriptions, types and required flags, which disrupts how submitted entries are stored.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","chatwiki","multi-tenant","self-hosted"],"not_affected_if":["single-tenant","version-2.10.0-or-later"],"how_to_check":"- Check the installed ChatWiki version and see whether it is below `2.10.0`.\n- Review whether multiple tenants share one ChatWiki instance, since that is where the flaw matters.","fix":"- ChatWiki: upgrade to `2.10.0` or later (the fixed version named in the advisory).","status":"open","published_at":"2026-11-06T15:17:20+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:36+00:00","updated_at":"2026-11-06T15:44:36+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T15:44:36Z","model":"claude-haiku-5-5","output":{"fix":"- ChatWiki: upgrade to `2.10.0` or later (the fixed version named in the advisory).","reach":"network","title":"ChatWiki: flaw lets one tenant edit another tenant's form fields","impact":"medium","summary":"ChatWiki before 2.10.0 fails to check that a form field belongs to the caller's tenant in SaveFormField and UpdateFormRequired. An authenticated user can change another tenant's field names, descriptions, types and required flags, which disrupts how submitted entries are stored.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["chatwiki","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Another tenant's form field definitions are altered, corrupting stored entries","analyst_note":"","how_to_check":"- Check the installed ChatWiki version and see whether it is below `2.10.0`.\n- Review whether multiple tenants share one ChatWiki instance, since that is where the flaw matters.","plain_action":"","needs_analyst":false,"not_affected_if":["single-tenant","version-2.10.0-or-later"],"who_is_affected":"Any ChatWiki deployment below 2.10.0 where several tenants share an instance and users have accounts. Single-tenant deployments or instances with only trusted users have a much smaller exposure. The sources do not describe a configuration that disables the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4323,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123782':14A,17A '-2026':13A,16A '2.10.0':30B,72C 'ai':19B 'ai-tool':18B 'allow':85C 'alongsid':106C 'alter':115C 'anoth':7A,53B,107C 'attack':94C 'authent':49B,86C 'belong':38B 'caller':41B 'chang':52B 'chatwiki':1A,21B,28B,70C 'check':33B,105C 'contain':73C 'cve':12A,15A 'descript':58B,118C 'direct':76C 'disrupt':64B,123C 'edit':6A 'entri':67B,126C 'fail':31B 'field':11A,37B,56B,93C,112C,116C 'flag':62B,122C 'flaw':2A 'form':10A,36B,92C,99C,111C 'host':27B 'id':100C,113C 'insecur':75C 'let':3A 'modifi':89C 'multi':23B 'multi-ten':22B 'name':57B,117C 'object':77C 'one':4A 'ownership':104C 'pass':96C 'refer':78C 'requir':61B,121C 'satisfi':102C 'saveformfield':45B,81C 'self':26B 'self-host':25B 'sequenti':110C 'store':69B,128C 'submit':66B,125C 'tenant':5A,8A,24B,43B,54B,91C,108C 'tool':20B 'type':59B,119C 'updateformrequir':47B,83C 'user':50B,87C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Any ChatWiki deployment below 2.10.0 where several tenants share an instance and users have accounts. Single-tenant deployments or instances with only trusted users have a much smaller exposure. The sources do not describe a configuration that disables the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","chatwiki","medium","multitenant","selfhosted"],"campaign_type":null,"search_a":"'-123782':14A,17A '-2026':13A,16A 'anoth':7A 'chatwiki':1A 'cve':12A,15A 'edit':6A 'field':11A 'flaw':2A 'form':10A 'let':3A 'one':4A 'tenant':5A,8A","search_b":"'2.10.0':30B 'ai':19B 'ai-tool':18B 'anoth':53B 'authent':49B 'belong':38B 'caller':41B 'chang':52B 'chatwiki':21B,28B 'check':33B 'descript':58B 'disrupt':64B 'entri':67B 'fail':31B 'field':37B,56B 'flag':62B 'form':36B 'host':27B 'multi':23B 'multi-ten':22B 'name':57B 'requir':61B 'saveformfield':45B 'self':26B 'self-host':25B 'store':69B 'submit':66B 'tenant':24B,43B,54B 'tool':20B 'type':59B 'updateformrequir':47B 'user':50B","search_c":"'2.10.0':72C 'allow':85C 'alongsid':106C 'alter':115C 'anoth':107C 'attack':94C 'authent':86C 'chatwiki':70C 'check':105C 'contain':73C 'descript':118C 'direct':76C 'disrupt':123C 'entri':126C 'field':93C,112C,116C 'flag':122C 'form':92C,99C,111C 'id':100C,113C 'insecur':75C 'modifi':89C 'name':117C 'object':77C 'ownership':104C 'pass':96C 'refer':78C 'requir':121C 'satisfi':102C 'saveformfield':81C 'sequenti':110C 'store':128C 'submit':125C 'tenant':91C,108C 'type':119C 'updateformrequir':83C 'user':87C 'vulner':79C","first_public_at":"2026-11-06T15:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123782","severity":null,"published_at":"2026-11-06T15:17:20+00:00","modified_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87581,"url":"https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322dd0881e1b8cfe85de337fdaf2b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87582,"url":"https://github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87583,"url":"https://github.com/zhimaAi/chatwiki/releases/tag/v2.10.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87590,"url":"https://www.vulncheck.com/advisories/chatwiki-before-2.10.0-cross-tenant-idor-via-saveformfield-and-updateformrequired","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}