ChatWiki versions before 2.10.0 contain an insecure direct object reference in the SaveFormField and UpdateFormRequired endpoints. An authenticated user can supply their own form_id to satisfy the ownership check while referencing another tenant’s sequential form_field id. This allows the attacker to modify field names, descriptions, types and the required flag, thereby altering how submissions are recorded and processed for that tenant.

All releases of zhimaAi’s ChatWiki product preceding version 2.10.0, including the 2.9.6 release and earlier. The vulnerability resides in the internal app chatwiki/business/manage package that handles form management.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a valid authenticated session; attackers can use the SaveFormField or UpdateFormRequired API endpoints (the likely attack vector is inferred from the endpoint names) to reference a form belonging to another tenant. Once exploited, the user can change form schemas and disrupt data handling for that tenant, representing a moderate risk due to the authentication prerequisite and potential for cross‑tenant impact.