CVE-2026-111656CWE-639

CVE-2026-111656

Medium · published October 16, 2026

CVSS v3.1

5.4

EPSS

Percentile

12.2

In the wild

Unconfirmed

What it is

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00223 · 12.2th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-10-16T22:17Z

References (4)

https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L1192-L1242 · [email protected]https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L878-L990 · [email protected]https://hackmd.io/@hieuPenguinnn/chatwiki-form-filter-cross-tenant-idor · [email protected]https://www.vulncheck.com/advisories/chatwiki-through-2.9.6-cross-tenant-idor-via-form-filter-management-endpoints · [email protected]

EPSS history

Timeline

18 OCT 03:27Z
EPSS moved — → 0%
epss
16 OCT 17:39Z
ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints
cvelistv5
16 OCT 17:39Z
ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints
cvelistv5