Which versions of Chatwoot are affected by EUVD-2026-16896?

Organizations using chatwoot should be aware of notable risk from CVE-2026-4990 rated CVSS 6.9. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2026-16896?

Within 30 days: Identify affected systems running chatwoot and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Chatwoot EUVD-2026-16896

Q: What is the CVSS score of EUVD-2026-16896?

EUVD-2026-16896 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4990 MEDIUM

Improper Authorization (CWE-285)

2026-03-27 VulDB

GHSA-4qxw-jjp5-4rvw

Authentication Bypass Chatwoot

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 27, 2026 - 22:00 euvd

EUVD-2026-16896

Analysis Generated

Mar 27, 2026 - 22:00 vuln.today

CVE Published

Mar 27, 2026 - 21:27 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

AnalysisAI

Improper authorization in Chatwoot up to version 4.11.1 allows remote unauthenticated attackers to bypass authentication via the signupEnabled parameter in the /app/login endpoint's Signup Endpoint component. The vulnerability enables attackers to manipulate signup authorization controls by setting signupEnabled to true, resulting in unauthorized access. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.

Technical ContextAI

The vulnerability resides in Chatwoot's authentication and authorization logic, specifically within the Signup Endpoint handler for the /app/login endpoint. The root cause is classified as CWE-285 (Improper Authorization), indicating that the application fails to properly enforce authorization controls when processing the signupEnabled parameter. The vulnerability allows an unauthenticated attacker to manipulate this parameter to enable signup functionality and bypass intended authorization restrictions, likely allowing registration or account access that should be restricted. Chatwoot is an open-source customer engagement platform, and this flaw affects all versions through 4.11.1.

RemediationAI

Immediately upgrade Chatwoot to a version newer than 4.11.1. The exact patched version is not specified in available vendor documentation; refer to the official Chatwoot GitHub repository (https://github.com/chatwoot/chatwoot) or release notes for the first available version after 4.11.1. As an interim measure prior to patching, restrict network access to the /app/login endpoint to trusted sources only, and audit recent signup activity for unauthorized accounts. Verify that the signupEnabled parameter cannot be externally manipulated through configuration hardening or environment variable settings if supported by your deployment model. Contact Chatwoot support directly for confirmation of the patched version if deploying in a critical production environment.