Chatwoot CVE-2025-12245

Exploitation targets the embeddable Chatwoot Widget specifically through the initPostMessageCommunication function in app/javascript/sdk/IFrameHelper.js, where the baseUrl argument is used without sufficient origin validation; the flaw is only reachable in deployments that embed the Chatwoot JavaScript chat widget on web pages. Impact is limited to low-level information disclosure (VC:L, no integrity or availability effect). Practical exploitation realistically depends on getting a victim to interact with an attacker-controlled or attacker-influenced page that establishes postMessage communication with the widget - a limiting factor the official UI:N vector does not reflect. Affected versions are Chatwoot up to and including 4.7.0.

This is a moderate-severity origin validation flaw (CWE-345) in Chatwoot's embeddable chat Widget, best treated as a lower-priority issue despite the 'remote' framing. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with only low confidentiality impact (VC:L) and no integrity or availability impact yields a base score of 5.5, and the embedded E:P exploit-maturity metric reflects that a proof-of-concept exists rather than mature/weaponized tooling. EPSS reinforces low real-world urgency: 0.33% probability at the 24th percentile, i.e. in the bottom quartile for likelihood of exploitation. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available PoC code (the hckwr.com blog write-up). The signals are internally consistent: a network-reachable, unauthenticated flaw with limited (information-disclosure-only) impact and modest exploitation probability. One caveat to verify: a postMessage origin-validation weakness typically requires a victim to load an attacker-influenced page or embed, yet the vendor vector asserts UI:N - real-world exploitation may in practice involve some user interaction (victim visiting a malicious page), which the official vector does not capture. Also note the vendor did not respond to disclosure, so there is no authoritative vendor advisory confirming affected versions or a fix.

An attacker hosts a malicious web page that loads or communicates with a Chatwoot widget and abuses the weak origin check in initPostMessageCommunication by manipulating the baseUrl argument, causing the widget to accept or send postMessage data across trust boundaries. Because origin validation is insufficient, the attacker can read information exchanged with the widget (low-impact disclosure). A public proof-of-concept exists (documented on hckwr.com), lowering the barrier to reproduction.