Threats affecting pkg:golang/chatwiki

ChatWiki versions before 2.10.0 have a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage endpoint. This flaw allows unauthenticated attackers to access PDF-rendered pages of other tenants' knowledge-base documents by enumerating sequential admin_user_id and file id parameters, bypassing ownership checks. The vulnerability is fixed in version 2.10.0.