Wimi Teamwork On-Premises Insecure Direct Object Reference Vulnerability in preview.php Endpoint

A vulnerability allowing insecure direct object reference has been identified in Wimi Teamwork On-Premises versions prior to 8.2.0. This vulnerability exists in the preview.php endpoint, where the item_id parameter is not properly authorized. As a result, attackers can sequentially enumerate item_id values to access and retrieve image previews from private or group conversations of other users, leading to unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows for unauthorized access to image previews from other users' private or group conversations, resulting in the disclosure of sensitive information.

Remediation

Users can update to Wimi Teamwork On-Premises version 8.2.0 or later to address this vulnerability.