---
id: "CVE-2026-123782"
page: "https://infrastack.ai/live/CVE-2026-123782"
kind: "vulnerability"
aliases: ["CVE-2026-123782"]
title: "ChatWiki: flaw lets one tenant edit another tenant's form fields"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "chatwiki", "multi-tenant", "self-hosted"]
not_affected_if: ["single-tenant", "version-2.10.0-or-later"]
published_at: "2026-11-06T15:17:20+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123782", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# ChatWiki: flaw lets one tenant edit another tenant's form fields

Link for people: https://infrastack.ai/live/CVE-2026-123782 (this .md is for agents)

ChatWiki before 2.10.0 fails to check that a form field belongs to the caller's tenant in SaveFormField and UpdateFormRequired. An authenticated user can change another tenant's field names, descriptions, types and required flags, which disrupts how submitted entries are stored.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ChatWiki version and see whether it is below `2.10.0`.
- Review whether multiple tenants share one ChatWiki instance, since that is where the flaw matters.

## Fix

- ChatWiki: upgrade to `2.10.0` or later (the fixed version named in the advisory).

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123782

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/chatwiki-before-2.10.0-cross-tenant-idor-via-saveformfield-and-updateformrequired
- [fix] Patch: github.com https://github.com/zhimaAi/chatwiki/commit/81dd7a34be0322dd0881e1b8cfe85de337fdaf2b
- [fix] Patch: github.com https://github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3
- [fix] Release notes: github.com https://github.com/zhimaAi/chatwiki/releases/tag/v2.10.0

## From the sources

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_