PT-2026-31307 · Cloud Solutions Sas · Wimi Teamwork

Noa Tchoumak + 1 · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35023

Mitre

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item id parameter lacks proper authorization checks. Attackers can enumerate sequential item id values to access and retrieve image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-35023

Affected Products

Wimi Teamwork

References · 3

• https://wimi-teamwork.com/en/product-update · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35023 · Security Note
• https://vulncheck.com/advisories/wimi-teamwork-on-premises-idor-via-preview-php · Note