CVE-2026-123782

ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form id to satisfy the ownership check alongside another tenant's sequential form field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored.