chatwoot vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20228
3. 20231
4. 20243
5. 20252
6. 20266

Newest CVEs

• CVE-2026-115725

  Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

  chatwoot · chatwoot

  Low2.3
• CVE-2026-113355

  Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

  chatwoot · chatwoot

  Medium4.8
• CVE-2026-72719

  Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

  chatwoot · chatwoot

  Medium6.7
• CVE-2026-63765

  Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

  chatwoot · chatwoot

  High8.8
• CVE-2026-44707

  Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

  chatwoot · chatwoot

  Medium6.8
• CVE-2026-44706

  Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values

  chatwoot · chatwoot

  High8.5
• CVE-2024-0640

  Stored XSS in chatwoot/chatwoot

  chatwoot · chatwoot/chatwoot

  Medium5.6
• CVE-2025-21628

  Chatwoot has a Blind SQL-injection in Conversation and Contacts filters

  chatwoot · chatwoot

  Critical9.1
• CVE-2021-3740

  Session Fixation in chatwoot/chatwoot

  chatwoot · chatwoot/chatwoot

  Medium6.8
• CVE-2021-3742

  Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

  chatwoot · chatwoot/chatwoot

  High7.9