What’s Vulnerable › Vulnerabilities

CVE-2026-115725: Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-23 · updated 2026-10-29
• Weakness: CWE-639

Description

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.

Affected products

• chatwoot/chatwoot: before 4.17.0 — fixed in 4.17.0

How to fix

Upgrade to a fixed version: chatwoot/chatwoot 4.17.0. Check the vendor advisory for mitigations.

References

• https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213
• https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27
• https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd
• https://github.com/chatwoot/chatwoot/pull/15521
• https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0
• https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id

Get alerted when CVE-2026-115725 or the next vulnerability affects your stack