CVE-2026-115725 in Chatwoot
Summary
by MITRE • 10/23/2026
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw in Chatwoot versions prior to 4.17.0 represents a critical authorization bypass vulnerability within the application’s multi-tenant architecture. This issue specifically impacts authenticated agent bots, which are designed to operate on behalf of specific customer support accounts. The core technical deficiency lies in the insufficient validation of the inbox source identifier during API request processing. When an agent bot initiates communication through the conversations create endpoint, the system fails to rigorously verify that the provided foreign contact inbox source_id belongs exclusively to the account associated with the authenticated session credentials. This lack of strict ownership verification allows a malicious actor who has compromised or controls one agent bot instance to manipulate API parameters and supply a source identifier belonging to a completely different tenant or customer account within the same Chatwoot deployment.
From an operational perspective, this vulnerability enables significant unauthorized access across organizational boundaries that are intended to be isolated by design. By exploiting this flaw, an attacker can create new conversations on behalf of other accounts, retrieve existing conversation histories, and post messages directly to contacts associated with those target accounts. This capability effectively breaks the multi-tenancy isolation model, allowing for data exfiltration from unrelated organizations or customers hosted on the same instance. The ability to inject messages into external contact streams also poses a severe risk of reputational damage and potential phishing campaigns if attackers leverage trusted support channels to deceive end-users.
In terms of industry classification standards, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to restrict access to resources based on user identity or role. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1078 Valid Accounts and sub-technique T1078.003 Cloud Accounts, where attackers leverage legitimate credentials for a specific service account to perform unauthorized actions across different organizational units. The attack vector is classified as remote with low complexity, requiring only authenticated access to one bot instance rather than network-level exploitation or complex social engineering beyond initial credential compromise.
To mitigate this risk, organizations running Chatwoot must immediately upgrade to version 4.17.0 or later, where the authorization logic has been corrected to enforce strict ownership checks on all inbox source identifiers during API operations. For environments that cannot be patched instantly due to operational constraints, temporary mitigations should include restricting network access to the application’s API endpoints using firewall rules or reverse proxy configurations to limit exposure only to trusted IP ranges. Additionally, implementing robust monitoring for anomalous patterns in conversation creation rates and cross-tenant message activity can help detect exploitation attempts early. Security teams should also audit existing bot permissions to ensure that agent bots operate with the principle of least privilege, minimizing the blast radius if a single bot credential is compromised.