Description

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T15:17:20.070Z",
  "pubdate": "2026-11-06T15:17:20.070Z",
  "executiveSummary": "ChatWiki versions prior to 2.10.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the fast command management system.\nThe vulnerability resides in the POST /manage/saveFastCommand endpoint, which fails to adequately validate tenant ownership during data modification requests.\nAn authenticated attacker can manipulate sequential IDs to overwrite sensitive configurations belonging to other tenants, including command titles, content, execution types, and robot bindings.\nThis flaw allows for unauthorized administrative control over cross-tenant resources, facilitating malicious activities such as URL redirection via webpage-jump commands and the illicit reassignment of records to the attacker's own tenant.\nThe risk is significant as it compromises the data integrity and security boundaries of multi-tenant environments, potentially leading to widespread service manipulation or phishing operations.\nSuccessful exploitation requires an authenticated session and knowledge of sequential record IDs, posing a critical threat to the logical isolation between separate tenant instances.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the authorization logic within the ChatWiki application, specifically at the /manage/saveFastCommand endpoint. The system relies on sequential identifiers to locate and update fast command records without performing a server-side check to ensure the authenticated user possesses the appropriate permissions to modify the target object associated with a different tenant.\nThe attack flow begins with an authenticated user observing the structure of HTTP requests sent to /manage/saveFastCommand. Upon identifying that the application utilizes predictable, sequential IDs to designate which command record to update, an attacker can craft malicious POST requests. By substituting the ID of a record owned by another tenant into the request parameters, the attacker bypasses the intended access control mechanism.\nWhen the server receives the manipulated POST request, the backend application processes the update instruction for the record specified by the ID. Because the application logic does not verify if the requesting user's tenant ID matches the record's associated tenant ID, it proceeds to commit the unauthorized modifications to the database. This allows the attacker to rewrite key attributes of the target object.\nThe payload behavior is versatile; an attacker can alter the 'title', 'type', 'content', and 'robot binding' fields of the command. A particularly severe vector involves modifying a 'webpage-jump' command to point to a malicious URL controlled by the attacker. Furthermore, by manipulating internal record identifiers, the attacker can effectively 'hijack' or reassign a command record so that it is associated with their own tenant's account, granting them persistent control over the resource.\nThe vulnerability affects all versions of ChatWiki prior to 2.10.0. The exploit is performable from any authenticated account, requiring no special administrative privileges beyond initial platform access. Given the reliance on predictable sequential IDs, an attacker can automate this process via enumeration to identify and compromise multiple tenant configurations systematically."
}