Chatwoot CVE-2026-4990

This vulnerability presents moderate real-world risk based on conflicting signals. The CVSS 4.0 vector indicates network-based unauthenticated access (AV:N, PR:N, UI:N) with low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and an exploitability modifier of E:P (Proof of Concept), yielding a CVSS score of 6.9 (Medium-High severity). However, the CVSS 4.0 scope is marked as Not Changed (S:X suggests evaluation limitation), and impact ratings are capped at low severity. The public availability of exploit code (E:P designation) elevates practical risk for organizations running affected Chatwoot versions. No EPSS probability score is provided, limiting quantitative exploitation prediction. The authentication bypass nature of the flaw is concerning because it could enable unauthorized account creation or access; however, the limited impact ratings suggest the post-exploitation capabilities may be restricted. Organizations should prioritize patching based on their exposure to untrusted networks and the sensitivity of customer engagement data stored in Chatwoot.

An unauthenticated attacker on the internet sends a crafted request to the /app/login endpoint of a Chatwoot instance, setting the signupEnabled parameter to true. This bypasses authorization controls that normally restrict signup functionality, allowing the attacker to create unauthorized user accounts or gain access to restricted features without authentication. With publicly available exploit code, this attack requires minimal technical skill and can be automated at scale across multiple Chatwoot instances.