Chatwoot EUVD-2026-104926

Requires an authenticated account administrator (PR:H) with permission to author Help Center / knowledge-base articles, and the Help Center must be publicly reachable so visitors load the article. The specific trigger is a CommonMark angle-bracket link destination of the form [text](<URL" ...>) placed in a video-embed link, where embedded double quotes escape the unescaped iframe src attribute built by render_embed_from_match. Exploitation is LIMITED by: the administrator privilege requirement (not available to unauthenticated or low-privileged users), the need for a public visitor to actually view the crafted article (UI:P, passive but still required), and the affected version being any release before 4.14.0.

This is a genuine but comparatively low-priority stored XSS (CVSS 4.0 base 4.8, Medium). The strongest mitigating signal is PR:H: per the description and the CVSS vector, exploitation requires an existing account administrator to author the malicious Help Center article, so this is a privileged-insider / compromised-admin-account issue rather than a path for anonymous attackers. UI:P further requires that a public visitor subsequently load the poisoned article. No EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The source-code diff (CGI.escapeHTML applied to captured values in render_embed_from_match) independently confirms the root cause and the fix, raising confidence that the technical mechanism is real. Net: a legitimate confirmed-and-patched vulnerability, but the administrator privilege requirement makes it far lower real-world risk than its CWE-79 class would suggest for an unauthenticated flaw; prioritize behind any network-reachable unauthenticated issues. Note the privilege boundary is nuanced - the injector is a trusted admin but the victim is an untrusted public visitor, which is why the vendor assigned a scope/subsequent-system impact (SC:L/SI:L).

A malicious or compromised account administrator authors a Chatwoot Help Center article containing a video-embed link whose angle-bracket destination includes double quotes, breaking out of the unescaped iframe src attribute in render_embed_from_match. When a public visitor opens the article, the injected JavaScript executes in their browser and exfiltrates the cw_conversation widget token. No public exploit code is identified at time of analysis, though the fix commit demonstrates the exact payload shape.