| शीर्षक | chatwoot 4.11.1 Business Logic Errors |
|---|
| विवरण | Summary
The Chatwoot contains a business logic vulnerability that allows attackers to bypass the intended signup restriction mechanism.
The application checks the response from the server (signupEnabled - Chatwoot config value) to determine whether new user registration is permitted. By intercepting and modifying the server response (using a proxy tool such as Burp Suite), an attacker can change the value of signupEnabled from false to true.
Because the server does not properly enforce this restriction with server-side validation, the manipulated value is accepted, allowing unauthorized users to register accounts (administrative) even when the signup functionality is intended to be disabled.
Details
Vulnerable Endpoint:
GET /app/login HTTP/2
Host: chatwoot.example.com |
|---|
| उपयोगकर्ता | Zabi_Ullah (UID 96130) |
|---|
| सबमिशन | 05/03/2026 07:35 AM (7 महीनों पहले) |
|---|
| संयम | 27/03/2026 02:48 PM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 353877 [chatwoot तक 4.11.1 Signup Endpoint /app/login signupEnabled अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|