CVE-2026-115725
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
chatwoot chatwoot
CVSS
2.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.17.0chatwootCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
Text from CVE List
Affected versions 1
- chatwootaffected: all versions before 4.17.0CVE List
References 6
- github.com/chatwoot/chatwoot/pull/15521Fixvia CVE List
- github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03ddFixvia CVE List
- github.com/chatwoot/chatwoot/releases/tag/v4.17.0Fixvia CVE List
- vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-idAdvisoryvia CVE List
- github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213Referencevia CVE List
- github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27Referencevia CVE List