Chatwoot CVE-2026-44706

Exploitation requires an authenticated Chatwoot user (CVSS PR:L) with access to at least one account that can invoke the filter APIs at /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, or /api/v1/accounts/{account_id}/custom_attribute_definitions, and the target account must have at least one custom attribute defined with type date or number against which the attacker can submit a filter using the is_greater_than or is_less_than operator - string-type attributes and other operators are not vulnerable. Limiting factors are that the attacker must already hold valid account credentials (no anonymous path), the injection is blind/time-based (no direct error or content oracle, slowing extraction), and the affected deployment must run a Chatwoot version in the 2.2.0-4.11.1 range; instances upgraded to 4.11.2 are not exploitable.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N indicates a remotely reachable, low-complexity flaw requiring only low-privilege authentication and producing a scope change with high confidentiality impact - consistent with a tenant-scoped account user reading data outside their authorization boundary via blind SQLi. EPSS is very low (0.03%, 8th percentile) and SSVC marks Exploitation as none, Automatable as no, and Technical Impact as partial, and the issue is not on CISA KEV - so real-world exploitation pressure is currently minimal even though the technical severity is high. The signals are internally consistent (no KEV, no POC, low EPSS, SSVC partial), but defenders should note that 'authenticated user with access to an account' in Chatwoot multi-tenant SaaS or self-hosted instances can be a very low bar (e.g., any agent or invited user), so the practical privilege barrier is weaker than PR:L might suggest in isolation.

An attacker registers or is invited as a low-privilege agent in a Chatwoot account, then sends a POST to /api/v1/accounts/{account_id}/conversations/filter with a filter targeting a date or number custom attribute and the is_greater_than operator, embedding a time-based blind SQL payload (e.g., a CASE/pg_sleep construct) in the values field. By measuring response latency across many crafted requests, the attacker exfiltrates data from other tenants' rows or system tables one bit at a time. No public exploit identified at time of analysis, but the technique is straightforward for any operator familiar with blind SQLi tooling such as sqlmap once the injection point is known.