CVE-2026-115725
CVE-2026-115725 · Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
chatwoot
- Versions
- ≥ 0, < 4.17.0: Affected (semver)
Update to 4.17.0
Original sources
- https://github.com/chatwoot/chatwoot/pull/15521
- https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd
- https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0
- https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213
- https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27
- https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id
- https://nvd.nist.gov/vuln/detail/CVE-2026-115725