chatwoot

9 results · Clear filters · Feed

• Medium 4.2
  CVE-2026-115725

  Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

  Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's sou…

  chatwoot chatwoot
  Oct 23, 2026
• Medium 4.8
  CVE-2026-113355

  Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

  Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to …

  chatwoot chatwoot
  Oct 20, 2026
• Medium 6.7
  CVE-2026-72719

  Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

  Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break ten…

  chatwoot chatwoot
  Aug 10, 2026
• Medium 6.8
  CVE-2026-44707

  Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

  Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre…

  chatwoot chatwoot
  May 26, 2026
• Medium 5.6
  CVE-2024-0640

  Stored XSS in chatwoot/chatwoot

  A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user…

  chatwoot chatwoot/chatwoot
  Mar 20, 2025
• Medium 6.8
  CVE-2021-3740

  Session Fixation in chatwoot/chatwoot

  A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized ac…

  chatwoot chatwoot/chatwoot
  Nov 15, 2024
• Medium 5.3
  CVE-2023-2109

  Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot

  Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.

  chatwoot chatwoot/chatwoot
  Apr 17, 2023
• Medium 6.5
  CVE-2021-3813

  Improper Privilege Management in chatwoot/chatwoot

  Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.

  chatwoot chatwoot/chatwoot
  Feb 9, 2022
• Medium 6.1
  CVE-2022-0527

  Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

  Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

  chatwoot chatwoot/chatwoot
  Feb 9, 2022