CVE-2026-111656 Details

A cross-tenant insecure direct object reference vulnerability has been identified in ChatWiki versions through 2.9.6. This vulnerability allows authenticated users to access and modify another tenant's form filters by supplying arbitrary form_id values. The issue arises because the form filter management handlers do not enforce ownership checks, enabling users to read filter rules and overwrite the sort order of filters belonging to other tenants.

The vulnerability can be addressed by adding ownership checks to the affected form filter management handlers. This involves verifying that the form_id belongs to the authenticated user's tenant before allowing access to the form filters or permitting any modifications. Additionally, consider adding a tenant column to the form_filter and form_filter_condition tables for added security.