Description

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T20:17:21.123Z",
  "pubdate": "2026-11-06T20:17:21.123Z",
  "executiveSummary": "ChatWiki versions prior to 2.10.0 are susceptible to a critical missing authentication vulnerability within the GET /manage/getLibRawFileOnePage API endpoint. This flaw permits unauthenticated, remote attackers to perform unauthorized read operations on sensitive documents belonging to other tenants. The vulnerability stems from a failure to enforce adequate access control mechanisms and ownership validation during the retrieval process of PDF-rendered knowledge-base pages. By manipulating predictable query parameters, an attacker can enumerate and exfiltrate proprietary data from any tenant's knowledge base. This represents a significant breach of multi-tenancy isolation, potentially leading to widespread information disclosure, loss of intellectual property, and compliance violations. The vulnerability is exploitable without authentication, necessitating immediate remedial action to ensure tenant data privacy and system integrity.",
  "technicalDetails": "The vulnerability resides in the server-side handling of the GET /manage/getLibRawFileOnePage route within the ChatWiki application. The root cause is a deficiency in the authorization logic, specifically the omission of an ownership check when processing document retrieval requests. When a user requests a file through this endpoint, the application fails to verify whether the requester possesses the appropriate authorization or tenant-level access rights to the requested resource. The backend code blindly processes the query parameters provided in the URL, which typically include 'admin_user_id' and 'file_id' identifiers.\nThe attack vector involves the exploitation of predictable, sequential identifiers. Because the application logic lacks server-side session-to-resource mapping, an unauthenticated attacker can construct a series of HTTP GET requests by systematically incrementing or brute-forcing the 'admin_user_id' and 'file_id' values. Upon receiving a request with valid (though stolen or guessed) identifiers, the server proceeds to fetch and render the requested document page from its storage backend and transmits the content back to the attacker's client.\nThe attack flow follows these steps: 1) The attacker targets the public-facing GET /manage/getLibRawFileOnePage endpoint. 2) The attacker crafts an HTTP request, injecting incrementing integer values into the 'admin_user_id' and 'file_id' query parameters. 3) The server, lacking input validation or authentication context, processes the request by retrieving the underlying file associated with those parameters. 4) The server renders the raw PDF content or document page and delivers it to the attacker in the response body. 5) By scripting this process, an attacker can programmatically exfiltrate an entire library of documents across multiple tenants.\nThis vulnerability is classified as an authorization bypass that effectively treats unauthorized requests as authenticated, privileged operations. The impact is severe, as the endpoint acts as an unauthenticated gateway to sensitive internal knowledge-base data. No specific privilege levels are required for exploitation, as the failure occurs before authentication is even evaluated. This flaw fundamentally undermines the multi-tenant architecture of the product, exposing all stored document data to any network-capable entity able to reach the ChatWiki instance."
}