CVE-2026-111656 zhimaAi CVE debrief

Who should care

Defenders responsible for ChatWiki installations, particularly those with multi-tenant environments, should assess exposure and prioritize patching. Security teams monitoring API activity and form filter management should also be aware of potential abuse patterns.

Why it matters

CVE-2026-111656 is a medium-severity vulnerability in ChatWiki that allows cross-tenant access and modification of form filters. Defenders should prioritize patching, restrict access controls, and monitor API requests to prevent exploitation and data exposure.

• Authenticated users can access form filters of other tenants, potentially exposing sensitive information.
• Attackers can overwrite filter sort orders of other tenants, leading to data integrity issues.
• Defenders need to verify and patch affected installations to prevent exploitation.
• Cross-tenant access may require additional monitoring and logging to detect potential abuse.

Technical summary

The ChatWiki application through version 2.9.6 contains an insecure direct object reference (IDOR) vulnerability. This allows authenticated users to access and modify form filters belonging to other tenants by supplying arbitrary form_id values in API requests to endpoints such as getFormFilterList, getFormFilterInfo, and updateFormFilterSort. The vulnerability, classified as CWE-639, enables attackers to read filter rules and overwrite another tenant's filter sort order.

Defensive priority

Defenders should prioritize verifying and patching affected ChatWiki installations, ensuring proper access controls for form filter management, and monitoring for potential abuse.

Recommended defensive actions

• Verify and apply the latest patches for ChatWiki, ensuring version 2.9.7 or later is deployed.
• Restrict access to form filter management endpoints to authorized users only.
• Monitor API requests for suspicious form_id manipulation attempts.
• Implement additional logging and auditing for form filter access and modifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and CWE-639 classification. Source references include GitHub code snippets and VulnCheck advisories. To verify and mitigate this vulnerability, defenders should review the official CVE record and NVD entry, assess the affected ChatWiki installations, and prioritize patching to version 2.9.7 or later. They should also restrict access to form filter management endpoints, monitor API requests for suspicious form_id manipulation attempts,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.