ChatWiki versions before 2.10.0 suffer from a missing authentication check in the GET /manage/getLibRawFileOnePage endpoint. This flaw allows an attacker to read any tenant’s PDF-rendered knowledge‑base documents by supplying sequential admin_user_id and file id values. The result is a breach of confidentiality, exposing sensitive business information from other tenants without requiring credentials. The vulnerability is rooted in improper authorization controls (CWE-306).

The vulnerability affects every instance of zhimaAi:chatwiki deployed with a version older than 2.10.0, including the earlier release 2.9.6. All tenants share the same code base, so any organization using a vulnerable version is susceptible to document disclosure.

The CVSS base score of 8.7 marks this as a high‑severity flaw, and the exploit is straightforward: an attacker merely sends an HTTP GET request with crafted query parameters. The EPSS score is not provided, but the lack of a KEV listing does not diminish the critical nature of the disclosure. Given the ease of enumeration and the absence of authentication, unauthenticated attackers can readily traverse a tenant’s document set, making the risk significant for any user hosting ChatWiki.