CVE-2026-115725— Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Quick assessment
Affected
chatwoot chatwoot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
4.17.0 之前的 Chatwoot 版本存在一个授权绕过漏洞。该漏洞允许已认证的代理机器人（agent bots）通过提供其他账户的联系人邮箱源 ID（source_id），从而访问其他账户。攻击者可以调用“创建对话”（conversations create）接口，传入其他账户的 source_id，以创建或检索对话，并向该账户的联系人发送消息。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115725
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Source: CVE Program / CVE List V5
Vulnerability Description
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-115725
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115725
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115725 (2)
-
🔗 chatwoot/app/policies/inbox_policy.rb at v4.16.2 · chatwoot/chatwoot · GitHub technical-description
-
Vendor Advisories for CVE-2026-115725 (1)
Proof of Concept for CVE-2026-115725 (1)
Vendor Pages for CVE-2026-115725 (1)
-
🔗 Release v4.17.0 · chatwoot/chatwoot · GitHub release-notes
IV. Related Vulnerabilities
Same product: chatwoot
-
CVE-2026-113355
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embe -
CVE-2026-92527
chatwoot Shopify OAuth callbacks_controller.rb server-side r -
CVE-2026-72719
Chatwoot: Cross-Account Resource Transfer via `account_id` P -
CVE-2026-63765
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Uploa -
CVE-2026-44707
Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Acco
Same vendor: chatwoot
-
CVE-2026-113355
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embe -
CVE-2026-72719
Chatwoot: Cross-Account Resource Transfer via `account_id` P -
CVE-2026-63765
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Uploa -
CVE-2026-44707
Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Acco -
CVE-2026-44706
Chatwoot: SQL Injection in Conversation/Contact Filter API v
Same weakness: CWE-639
-
CVE-2026-93634
Zimbra Collaboration Suite Cross-Account Authorization Bypas -
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gate -
CVE-2026-115453
Cross user deletion and modification of cart and wishlist ro -
CVE-2026-115334
Lotus through 0.10.2 Authorization Bypass via switch_organiz -
CVE-2026-115329
Lotus through 0.10.2 Cross-Organization IDOR via Subscriptio
V. Comments for CVE-2026-115725
No comments yet