chatwoot has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 4.8 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Worst active — by depth score
CVE-2026-63765High· 8.2Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account57CVE-2026-113355Medium· 4.8Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links26CVE-2026-115725Medium· 4.2Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id23
chatwoot vulnerabilities
CVEs affecting chatwoot, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-115725Medium· 4.2Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with…
CVE-2026-113355Medium· 4.8Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations …
CVE-2026-63765High· 8.2PoCChatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing au…