This vulnerability affects chatwoot versions 4.11.0 and 4.11.1 in the Signup Endpoint component located in /app/login. By manipulating the signupEnabled parameter to true, an attacker can bypass proper authorization controls, potentially gaining unauthorized access or privileges. The vulnerability is remotely exploitable without requiring user interaction or privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and no cloud service remediation applies.

Improper authorization may allow remote attackers to bypass access controls at the signup endpoint, potentially enabling unauthorized account creation or privilege escalation. The impact is rated medium with a CVSS score of 6.9. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, consider implementing additional access controls or network-level restrictions around the signup endpoint to reduce exposure.