Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Sign Up →
high·Product Based Web Vulnerabilities·Updated Nov 13, 2026

ChatWiki < 2.10.0 - Cross-Tenant Document Page Disclosure

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
0
Times Used
continuous scan runs
10
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
8.7
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
chatwikiby zhimaAi
AFFECTED< 2.10.0→SAFE ✓≥ 2.10.0
Updated Nov 13, 2026View on NVD →

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Browse All Tools