CVE-2026-115725
CVE-2026-115725 · Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
CVSS 2.3 · Baja · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
chatwoot
- Versiones
- ≥ 0, < 4.17.0: Afectada (semver)
Actualiza a 4.17.0
Fuentes originales
- https://github.com/chatwoot/chatwoot/pull/15521
- https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd
- https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0
- https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213
- https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27
- https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id
- https://nvd.nist.gov/vuln/detail/CVE-2026-115725