CVE-2026-35023 is an authorization bypass vulnerability (CWE-639) in Cloud Solutions SAS's Wimi Teamwork On-Premises versions before 8.2.0. The issue exists in the preview.php endpoint where the item_id parameter lacks proper authorization checks. Attackers can sequentially enumerate item_id values to retrieve image previews from other users' private or group conversations without appropriate permissions, leading to unauthorized information disclosure. The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required. The CVSS 4.0 vector indicates no privileges required but low impact on confidentiality.

Exploitation allows an attacker with limited privileges to access image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information. The impact is limited to confidentiality with low severity impact on data confidentiality as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, restricting access to the preview.php endpoint or implementing additional access controls may help mitigate risk.