Is CVE-2026-111656 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111656?

CVE-2026-111656 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-111656

Description

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.