Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a… (CVE-2026-115725)

The vulnerability in Chatwoot prior to version 4.17.0 involves an authorization bypass where authenticated agent bots can supply a foreign contact inbox source_id to the conversations create endpoint. This allows them to create or retrieve conversations and post messages associated with other accounts, bypassing intended access controls.

An attacker with authenticated agent bot privileges can access and manipulate conversations belonging to other accounts by exploiting the authorization bypass. This leads to unauthorized disclosure and modification of conversation data, impacting confidentiality and integrity with limited scope due to required authentication and high attack complexity.

A fix is available in Chatwoot version 4.17.0. Users should upgrade to version 4.17.0 or later to remediate this vulnerability. No vendor advisory is provided to indicate alternative mitigations or temporary fixes.