CVE-2026-35023 Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php
Attackers can access private image previews from other users' conversations by manipulating item_id parameters in the preview endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35023?
CVE-2026-35023 is a medium-severity missing authorization vulnerability in Cloud Solutions SAS Wimi Teamwork, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id parameter lacks proper authorization checks. Attackers can enumerate sequential item_id values to access and retrieve image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information.
Weakness: CWE-639
Which versions are affected by CVE-2026-35023?
It affects 1 product.
Products include Wimi-Teamwork Wimi-Teamwork.
How do I fix CVE-2026-35023?
No fix has been published for CVE-2026-35023 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35023 being exploited?
There is no known exploitation of CVE-2026-35023 in the wild and no public exploit code.
Sources
Also known as GHSA-gg3g-v6xg-6h6p.