CVE-2026-123782 Details

A cross-tenant insecure direct object reference vulnerability has been identified in ChatWiki versions prior to 2.10.0. This vulnerability allows authenticated users to manipulate form field definitions belonging to other tenants. The issue arises in the form management API, specifically within the 'SaveFormField' and 'UpdateFormRequired' handlers, which fail to enforce proper ownership checks. Attackers can exploit this by providing their own 'form_id' to bypass ownership verification and then use a victim tenant's 'form_field' id to make unauthorized changes. As a result, attackers can alter field attributes such as names, descriptions, types, and required flags, disrupting the integrity of form data management.

Users can update to ChatWiki version 2.10.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the ChatWiki release notes.