CVE-2026-124027 Scanner
CVE-2026-124027 Scanner - Information Disclosure vulnerability in ChatWiki
Used 3 times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-124027
8.7
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
chatwiki
Updated Nov 13, 2026View on NVD →
S4E scanner
CVE history: chatwiki
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →