Chatwoot up to 4.12.x unverified ownership

Summaryinfo

A vulnerability marked as problematic has been reported in Chatwoot up to 4.12.x. Affected by this vulnerability is an unknown functionality. This manipulation causes unverified ownership. This vulnerability is handled as CVE-2026-44707. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Chatwoot up to 4.12.x. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a unverified ownership vulnerability. The CWE definition for the vulnerability is CWE-283. The product does not properly verify that a critical resource is owned by the proper entity. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-44707 since 05/07/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 4.13.0 eliminates this vulnerability. Applying the patch 211fb1102dd208daee414cff1b8d71ea27ac5ebf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Chat Software

Name

• Chatwoot

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12

License

• open-source

Website

• Product: https://github.com/chatwoot/chatwoot/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion