Medium severity5.4NVD Advisory· Published Nov 6, 2026· Updated Nov 6, 2026
CVE-2026-123624
CVE-2026-123624
Description
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
7- github.com/zhimaAi/chatwiki/blob/v2.9.6/internal/app/chatwiki/business/manage/fast_command.gonvd
- github.com/zhimaAi/chatwiki/commit/81dd7a34be0322dd0881e1b8cfe85de337fdaf2bnvd
- github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3nvd
- github.com/zhimaAi/chatwiki/issues/180nvd
- github.com/zhimaAi/chatwiki/releases/tag/v2.10.0nvd
- hackmd.io/@hieuPenguinnn/chatwiki-fast-command-cross-tenant-idornvd
- www.vulncheck.com/advisories/chatwiki-before-2.10.0-cross-tenant-fast-command-modification-via-savefastcommandnvd
News mentions
0No linked articles in our index yet.