Threat Intelligence Database

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-92527 is a server-side request forgery (SSRF) vulnerability in chatwoot versions 4.17.0 and 4.17.1. It affects an unknown function within the Shopify OAuth component in the callbacks_controller.rb file. The vulnerability allows remote attackers to induce the server to make unintended requests. The issue was publicly disclosed and reported to the project, but no response or fix has been provided yet. The CVSS 4.0 score rates this vulnerability as medium severity.

Chatwoot versions prior to 4.16.0 have an authentication bypass vulnerability in the direct uploads controller. This flaw allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks. Attackers can resolve any account and conversation and obtain signed PUT URLs to write arbitrary data to the application's storage backend. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-12246