CVE-2026-35023 is an authorization bypass vulnerability (CWE-639) affecting Wimi Teamwork On-Premises versions before 8.2.0. The issue exists in the preview.php endpoint where the item_id parameter is not properly authorized, enabling attackers with limited privileges to sequentially enumerate item_id values and retrieve image previews belonging to other users. This results in unauthorized access to potentially sensitive images shared in private or group conversations. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.3. There is no vendor-provided patch or official remediation information at this time.

Attackers with limited privileges can exploit this vulnerability to bypass authorization controls and access image previews from other users' private or group conversations. This leads to unauthorized disclosure of sensitive information. There is no indication of privilege escalation, remote code execution, or other impacts beyond information disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the preview.php endpoint to trusted users only and monitor for suspicious enumeration activity. Avoid exposing the affected versions in untrusted environments.