CVE-2026-72719 in Chatwoot
Summary
by MITRE • 08/10/2026
Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Chatwoot's account management system where authenticated administrators could exploit a writable account_id parameter to transfer critical resources between accounts. The flaw represents a significant authorization bypass that undermines the fundamental security principle of tenant isolation, allowing malicious actors with administrator privileges to manipulate cross-account resource ownership. The affected components include Portals, Automation Rules, Macros, and Twilio Channels which are essential for customer engagement operations and contain sensitive configuration data. This vulnerability directly maps to CWE-285: Improper Authorization, where the system fails to properly verify that the requesting user has sufficient privileges to perform the requested action on the target resource.
The technical implementation flaw stems from insufficient input validation and access control enforcement within the account transfer functionality. When administrators attempt to transfer resources between accounts, the system accepts a mutable account_id parameter without proper authorization checks to ensure the administrator has the right to modify the target account's resources. This creates an opportunity for privilege escalation where authenticated users can manipulate resource ownership and potentially gain unauthorized access to another organization's customer data, automated workflows, or communication channels. The vulnerability operates at the application layer and could be exploited through API calls or web interface interactions that allow modification of account identifiers.
The operational impact of this vulnerability extends beyond simple data exposure to encompass complete compromise of tenant isolation mechanisms that are critical for multi-tenant SaaS platforms. Organizations using Chatwoot may experience unauthorized access to customer support portals, automated response systems, and communication integrations belonging to other accounts. This could result in data leakage, service disruption, unauthorized configuration changes that affect business operations, or complete loss of control over transferred resources. The vulnerability affects the core integrity of the platform's multi-tenant architecture and could potentially enable attackers to perform lateral movement between customer accounts, leading to widespread data exposure across multiple organizations.
Organizations should immediately upgrade to Chatwoot version 4.9.0 which implements proper access controls and input validation for account transfer operations. System administrators should conduct thorough audits of existing transfers that may have occurred before the patch was applied, reviewing all resource ownership changes and identifying potential unauthorized modifications. Additional mitigations include implementing strict role-based access controls that limit account transfer permissions to specific administrative roles, establishing monitoring for unusual resource ownership changes, and validating account_id parameters through multiple authorization checks before processing any transfer requests. The fix aligns with ATT&CK technique T1548.005: Service Execution which addresses unauthorized access to resources through improper privilege management and highlights the importance of proper access control enforcement in multi-tenant environments.