What is the CVSS score of CVE-2026-72719?

CVE-2026-72719 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-72719?

Yes, a patch is available for CVE-2026-72719. Update the affected software to the latest version immediately.

Chatwoot CVE-2026-72719

Q: Which versions of Chatwoot are affected by CVE-2026-72719?

Chatwoot's multi-tenant API fails to restrict the `account_id` parameter in four controllers (Portals, Automation Rules, Macros, Twilio Channels), enabling authenticated account administrators to…. A patch is available.

EUVD-2026-55654 MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-08-10 GitHub_M

Information Disclosure Chatwoot

6.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

6.7 MEDIUM

Network-reachable API requires account admin auth (PR:H); no complexity beyond auth; cross-tenant data read and write, minimal availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:06 vuln.today

Analysis Generated

Aug 10, 2026 - 16:06 vuln.today

DescriptionCVE.org

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.

AnalysisAI

Chatwoot's multi-tenant API fails to restrict the account_id parameter in four controllers (Portals, Automation Rules, Macros, Twilio Channels), enabling authenticated account administrators to reassign resources across tenant boundaries. An admin in Account A can transfer owned resources - including Twilio channel credentials and automation configurations - into arbitrary target accounts, causing cross-account data exposure, unauthorized configuration modification, or denial of access to transferred resources. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as Chatwoot account administrator

Delivery

Enumerate or guess target tenant account ID

Exploit

Craft API update request with injected account_id parameter

Execution

Submit request to affected controller (automation rules, macros, portals, or Twilio channel)

Persist

Resource ownership transferred to target account

Impact

Access or disrupt cross-tenant configuration and credentials

Access

Authenticate as Chatwoot account administrator

Delivery

Enumerate or guess target tenant account ID

Exploit

Craft API update request with injected account_id parameter

Execution

Submit request to affected controller (automation rules, macros, portals, or Twilio channel)

Persist

Resource ownership transferred to target account

Impact

Access or disrupt cross-tenant configuration and credentials

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active Chatwoot session authenticated as an account-level administrator (CVSS PR:H confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) correctly captures the key risk trade-off: the high-privileges requirement (PR:H - account administrator) substantially limits exploitability to insider threats or compromised admin accounts, while the confidentiality and integrity impacts are high once that bar is cleared. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A malicious or compromised account administrator authenticates to Chatwoot and issues a PATCH request to update an automation rule within their account, injecting `account_id: <victim_tenant_id>` into the request body. Chatwoot's controller accepts the parameter and persists the resource under the target tenant's account ID, effectively exfiltrating the rule configuration - including any embedded credentials or sensitive logic - into the target account. …
Remediation	Upgrade to Chatwoot v4.9.0 or later - the patch is confirmed released via GitHub release tag and commit 86da3f7c069f8ed6dce2576e1a760ca72b6f40fd, which removes `:account_id` from permitted parameters in the four affected controllers. … Detailed patch versions, workarounds, and compensating controls in full report.