CVE-2026-124027

High

Description

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.

SeverityHigh

CVSS7.5

Exploit probability—

ProductZhimaai Chatwiki

PublishedNov 6, 2026

First seenNov 6, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

zhimaAi chatwiki2.10.0 or later

Patches

github.com/zhimaAi/chatwiki/commit/d1ca145e283e2cb652e0b1002d5f14d6a46671e3

Vendor advisories

github.com/zhimaAi/chatwiki/releases/tag/v2.10.0

Affected products

Product	Affected versions	Fixed in
zhimaAi chatwiki	v < 2.10.0	2.10.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.