Skip to main content

Chatwoot EUVDEUVD-2026-48360

| CVE-2026-63765 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-07-23 VulnCheck GHSA-9wjj-m9cm-hjjc
Authentication Bypass Chatwoot
8.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Unauthenticated network endpoint with missing auth (PR:N/AV:N/AC:L/UI:N); impact is arbitrary storage writes (I:H) plus storage exhaustion (A:L), no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 18:45 vuln.today
Analysis Generated
Jul 23, 2026 - 18:45 vuln.today
CVE Published
Jul 23, 2026 - 17:52 cve.org
HIGH 8.8

DescriptionCVE.org

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

AnalysisAI

Unauthenticated arbitrary blob creation in Chatwoot before 4.16.0 lets remote attackers abuse the ActiveStorage direct-uploads controller, which lacks authentication (CWE-306), to resolve any tenant's account and conversation and obtain signed PUT URLs for writing attacker-controlled data into the shared storage backend. The flaw affects all self-hosted and multi-tenant Chatwoot deployments prior to 4.16.0, is reported by VulnCheck, and has publicly available exploit code exists (no CISA KEV listing). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed Chatwoot endpoint
Delivery
Call direct-uploads controller unauthenticated
Exploit
Resolve arbitrary account and conversation
Execution
Obtain signed PUT URL
Persist
Write arbitrary blob to storage
Impact
Cross-tenant data pollution or storage exhaustion
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to the Chatwoot HTTP application and specifically to the ActiveStorage direct-uploads controller endpoint; per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special attack requirement, so a default internet-exposed Chatwoot instance older than 4.16.0 is directly exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are largely consistent and point to a genuine priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote attacker with no credentials sends crafted requests to an internet-exposed Chatwoot instance's ActiveStorage direct-uploads controller, specifying an arbitrary account and conversation ID, and receives signed PUT URLs. Using the public POC, they write arbitrary attacker-controlled blobs into another tenant's storage - polluting attachments, planting malicious files, or exhausting storage - all without authenticating or interacting with any user.
Remediation Vendor-released patch: 4.16.0 - upgrade all Chatwoot instances (self-hosted and multi-tenant) to 4.16.0 or later, which adds the missing authentication check to the direct uploads controller (fix commit 8dd0d08322edafaec24624b72ed2f6045921cb7b, PR 15039; release notes at https://github.com/chatwoot/chatwoot/releases/tag/v4.16.0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Chatwoot installations and identify their current versions, focusing on production and multi-tenant systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chatwoot

View all
CVE-2022-3741 CRITICAL POC
9.8 Oct 28

Impact varies for each individual vulnerability in the application. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2021-3649 HIGH POC
7.5 Jul 16

chatwoot is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability

CVE-2022-2901 HIGH POC
7.1 Sep 06

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. Rated high severity (CVSS 7.1), this vulnera
CVE-2022-0542 MEDIUM POC
6.1 Aug 19

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. Rated medium severity (CVSS 6.1)
CVE-2022-1021 MEDIUM POC
5.4 Aug 19

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. Rated medium severity (
CVE-2022-1022 MEDIUM POC
5.4 Apr 21

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. Rated medium severity (CVSS 5
CVE-2024-0640 MEDIUM POC
4.8 Mar 20

A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. Rated medium seve
CVE-2026-44706 HIGH
8.5 May 26

SQL injection in Chatwoot versions 2.2.0 through 4.11.1 allows any authenticated account user to execute arbitrary SQL v
CVE-2026-44707 MEDIUM
6.8 May 26

Pre-Account Takeover in Chatwoot's OmniAuth integration affects all releases from 2.14.0 through 4.12.x, allowing an att
CVE-2026-72719 MEDIUM
6.7 Aug 10

Chatwoot's multi-tenant API fails to restrict the `account_id` parameter in four controllers (Portals, Automation Rules,
CVE-2025-12246 LOW POC
2.1 Oct 27

Cross-site scripting (XSS) in Chatwoot up to version 4.7.0 allows remote attackers to inject malicious scripts via the L
CVE-2023-2109 MEDIUM
6.1 Apr 17

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. Rated medium severity (CVSS 6.1

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-48360 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy