Threat database

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

CVE-2026-92527 is a server-side request forgery (SSRF) vulnerability in chatwoot versions 4.17.0 and 4.17.1. It affects an unknown function within the Shopify OAuth component in the callbacks_controller.rb file. The vulnerability allows remote attackers to induce the server to make unintended requests. The issue was publicly disclosed and reported to the project, but no response or fix has been provided yet. The CVSS 4.0 score rates this vulnerability as medium severity.

Chatwoot versions prior to 4.16.0 have an authentication bypass vulnerability in the direct uploads controller. This flaw allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks. Attackers can resolve any account and conversation and obtain signed PUT URLs to write arbitrary data to the application's storage backend. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).