CVE-2026-63765highCWE-306

CVE-2026-63765: high-severity vulnerability in chatwoot

Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

Published · Updated

Follow this CVE+ Monitor chatwoot

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.7%
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
chatwoot · chatwoot
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — chatwoot

In the same product, most dangerous first.

CVE-2025-21628CRITICALChatwoot has a Blind SQL-injection in Conversation and Contacts filtersEPSS 0.7%CVE-2026-72719MEDIUMChatwoot: Cross-Account Resource Transfer via `account_id` ParameterEPSS 0.6%CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2026-115725LOWChatwoot before 4.17.0 Cross-Account Authorization Bypass via source_idEPSS 0.2%CVE-2026-113355MEDIUMChatwoot before 4.14.0 Stored XSS via Help Center Video Embed LinksEPSS 0.2%CVE-2026-44706HIGHChatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute ValuesEPSS 0.2%