Chatwoot CVE-2026-5205

Q: What is the CVSS score of CVE-2026-5205?

CVE-2026-5205 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17532 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-31 VulDB

SSRF Chatwoot

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 31, 2026 - 17:16 euvd

EUVD-2026-17532

Analysis Generated

Mar 31, 2026 - 17:16 vuln.today

CVE Published

Mar 31, 2026 - 16:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in Chatwoot up to version 4.11.2 allows authenticated remote attackers to manipulate the URL argument in the Webhooks::Trigger function, enabling arbitrary HTTP requests from the server. Publicly available exploit code exists, and the vendor has not responded to disclosure efforts. While CVSS is moderate (5.3), the presence of public POC and authenticated attack vector creates a meaningful exploitation risk for deployed instances.

Technical ContextAI

The vulnerability exists in the Webhook API component, specifically within the Webhooks::Trigger function located in lib/webhooks/trigger.rb. The flaw is classified as CWE-918 (Server-Side Request Forgery), which occurs when user-controlled input (the URL argument) is passed to HTTP request functionality without proper validation or restriction. This allows an attacker to forge requests originating from the vulnerable server itself, potentially targeting internal services, metadata endpoints, or other network-accessible resources that the server can reach but the attacker cannot directly access. The CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L) indicates the vulnerability requires authenticated access (PR:L) and low attack complexity, suggesting the attacker must have valid user credentials but no special conditions are needed to trigger the flaw.

RemediationAI

Immediate remediation requires upgrading Chatwoot to a patched version beyond 4.11.2 when available; monitor the official Chatwoot repository and release notes for security updates addressing this SSRF. Until a patch is released, implement compensating controls: restrict access to the Webhook API to trusted users only, implement network-level egress filtering to prevent the server from reaching sensitive internal services or cloud metadata endpoints (e.g., 169.254.169.254 for AWS/Azure), and use a WAF or API gateway to validate and whitelist permitted webhook URLs. Review webhook configurations for suspicious or unexpected URLs. For immediate visibility, audit webhook logs in lib/webhooks/trigger.rb execution paths for anomalous requests. Reference VulDB entry 354333 for updates on patch availability and community-provided fixes.