Wimi Teamwork On‑Premises versions earlier than 8.2.0 contain an insecure direct object reference in the preview.php endpoint. The item_id parameter is not verified for proper authorization, allowing an attacker to enumerate sequential identifiers and retrieve image previews from private or group conversations. The unintended disclosure of user‑contributed images results in access to confidential or personal data that belongs to other users.

Cloud Solutions SAS’s Wimi Teamwork On‑Premises installations running any version prior to 8.2.0 are affected. The vulnerability exists wherever preview.php is exposed, and any user who can supply an item_id value will be able to trigger the IDOR behavior.

The assigned CVSS v3 base score of 5.3 reflects moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the web interface, and the flaw requires only enumeration of predictable item_id values—an action that can be automated once the attacker has network or web access to the application.