CVE-2026-35023

CVE-2026-35023 is an insecure direct object reference vulnerability affecting Wimi Teamwork On-Premises versions prior to 8.2.0. The flaw exists in the preview.php endpoint where the item_id parameter lacks proper authorization checks, allowing attackers to enumerate sequential values and access image previews from other users' private or group conversations without authorization. The vulnerability has a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and low privileges. The attack requires no user interaction and results in confidentiality impact through unauthorized information disclosure, though integrity and availability are not affected. This vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and shows minimal community attention with no active exploitation reported. The extremely low EPSS score of 0.00028 indicates negligible likelihood of exploitation in the wild, suggesting the vulnerability poses a low practical risk despite its authorization bypass nature.