CVE-2026-115725lowCWE-639

CVE-2026-115725: falha de baixa gravidade em chatwoot

Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar chatwoot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.2%
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
chatwoot · chatwoot
CVEs relacionadas — chatwoot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63765HIGHChatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob CreationEPSS 0.7%CVE-2025-21628CRITICALChatwoot has a Blind SQL-injection in Conversation and Contacts filtersEPSS 0.7%CVE-2026-72719MEDIUMChatwoot: Cross-Account Resource Transfer via `account_id` ParameterEPSS 0.6%CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2026-113355MEDIUMChatwoot before 4.14.0 Stored XSS via Help Center Video Embed LinksEPSS 0.2%CVE-2026-44706HIGHChatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute ValuesEPSS 0.2%