Skip to content
Threat Feed
Subscribe
high advisory

ChatWiki: Authentication bypass in getLibRawFileOnePage (CVE-2026-124027)

ChatWiki before version 2.10.0 contains an authentication bypass vulnerability in the GET /manage/getLibRawFileOnePage route, allowing unauthenticated attackers to enumerate parameters and access unauthorized tenant documents.

CVE search metadata

CVE search record: CVE-2026-124027. Severity: high. CVSS: 7.5. KEV: no. Product: ChatWiki (< 2.10.0). Brief: ChatWiki: Authentication bypass in getLibRawFileOnePage (CVE-2026-124027). Brief link: https://feed.craftedsignal.io/briefs/2026-11-chatwiki-auth-bypass/

Triage facts

Revision 1
Applicability
ChatWiki (< 2.10.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 6, 21:29 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

ChatWiki versions prior to 2.10.0 contain a missing authentication vulnerability in the 'GET /manage/getLibRawFileOnePage' route. This vulnerability allows an unauthenticated attacker to retrieve PDF-rendered pages of documents belonging to any tenant. By enumerating 'admin_user_id' and 'file_id' query parameters, an attacker can bypass authorization checks to access data across the platform.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive knowledge-base documents from other tenants, leading to unauthorized information disclosure and potential cross-tenant data leakage.

Recommendation

  • Upgrade all ChatWiki instances to version 2.10.0 or later to remediate the missing authentication flaw in the 'getLibRawFileOnePage' endpoint.
  • Audit access logs for high-frequency 'GET' requests to '/manage/getLibRawFileOnePage' originating from unauthenticated sessions or unauthorized IP addresses, specifically looking for sequential enumeration of query parameters.

Immediate actions

Upgrade ChatWiki to 2.10.0

IT Operations 48h

Threat Hunt

Identify unauthorized access to management endpoints

T1592 high high confidence hunt now

Data: Web server access logs

Mitigations

Upgrade ChatWiki to version 2.10.0 or later

immediate IT Operations

CVE-2026-124027

Detection coverage 1

Detect Potential Document Enumeration via ChatWiki

high

Detects suspicious sequential access to the getLibRawFileOnePage endpoint which may indicate exploitation of CVE-2026-124027

sigma tactics: exfiltration techniques: T1592 sources: webserver

Detection queries are available on the platform. Get full rules →