Chatwoot CVE-2026-115725

The attacker must be an authenticated agent bot holding a valid Chatwoot API access token (PR:L) and must supply a source_id that corresponds to a contact inbox belonging to a different account. The practical limiting factors are: valid agent bot credentials are required (not an unauthenticated attacker), the attacker must know or obtain a foreign account's valid contact-inbox source_id (reflected as AT:P), and the affected deployment must run Chatwoot before 4.17.0. Impact is bounded to creating/retrieving conversations and posting messages to the targeted account's contacts; there is no availability impact and no confirmed subsequent-system impact. Risk is meaningful primarily on shared/multi-tenant instances where multiple accounts coexist.

All decision signals point to a genuinely low-priority issue rather than a high-CVSS-but-overrated one - indeed the CVSS itself is low. The source-provided CVSS 4.0 base score is 2.3 with vector AV:N/AC:L/AT:P/PR:L/UI:N and only VC:L/VI:L/VA:N, and the vuln.today decision label is 'monitor'. PR:L confirms this requires an authenticated principal (an agent bot with a valid API access token), and AT:P reflects that successful exploitation depends on the attacker obtaining a valid contact-inbox source_id belonging to another account - a value outside the attacker's direct control. There is no CISA KEV listing and no EPSS probability was supplied in the input, so widespread or automated exploitation cannot be inferred; no public exploit code was identified either. The impact is confined to creating/retrieving conversations and posting messages to another account's contacts (low confidentiality and integrity, no availability or subsequent-system impact). The cross-account/multi-tenant nature is the only aggravating factor and matters mainly for shared SaaS or multi-tenant Chatwoot deployments, but the low impact metrics and the authenticated-plus-foreign-source_id prerequisite keep real-world risk low and likely targeted rather than opportunistic. EPSS data is missing from the input, so probabilistic exploitation likelihood could not be cross-checked.

On a multi-tenant Chatwoot instance, an attacker who controls an agent bot in their own account obtains its API access token and calls the conversations create endpoint supplying a source_id that belongs to a contact inbox in a different account. Because the pre-4.17.0 lookup resolves the ContactInbox by source_id without scoping it to the caller's account, the attacker can create or retrieve conversations and post messages to the victim account's contacts. No public exploit was identified; the fix PR and its accompanying spec test demonstrate the mechanism.