{"id":"CVE-2026-111656","summary":"ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints","details":"ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.","modified":"2026-10-28T02:30:22.971151683Z","published":"2026-10-16T17:39:22.093Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111656.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111656.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/chatwiki-form-filter-cross-tenant-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111656"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/chatwiki-through-2.9.6-cross-tenant-idor-via-form-filter-management-endpoints"},{"type":"PACKAGE","url":"https://github.com/zhimaAi/chatwiki"},{"type":"ARTICLE","url":"https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L1192-L1242"},{"type":"ARTICLE","url":"https://github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/form.go#L878-L990"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zhimaai/chatwiki","events":[{"introduced":"0"},{"last_affected":"15e1fa2bd85ac3fd6da0e74e3c70494284317a64"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"2.9.6"}]},{"range":[{"introduced":"0"},{"last_affected":"2.9.6"}],"source":"DESCRIPTION"}]}}],"versions":["v2.9.6","v2.9.5","v2.9.4","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.1","v2.8.0","v2.7.0","v2.6.3","v2.6.2","v2.6.1","v2.6.0","v2.5.4","v2.5.3","v2.5.2","v2.5.1","v2.5.0","v2.4.10","v2.4.9","v2.4.8","v2.4.7","v2.4.6","v2.4.5","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.0","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111656.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}