CVE-2026-115725 chatwoot CVE debrief

Who should care

Defenders responsible for Chatwoot instances, security teams, and administrators should assess exposure and take necessary actions. They should verify the Chatwoot version, review and restrict access to conversations create endpoint, and monitor for suspicious activity on Chatwoot instances. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and 7

Why it matters

CVE-2026-115725 is a low-severity vulnerability in Chatwoot before 4.17.0 that allows authenticated agent bots to access other accounts. Defenders should verify exposure, restrict access, and upgrade to version 4.17.0 or later.

• Potential unauthorized access to conversations and contacts
• Possible data exposure or tampering
• Need for verification of Chatwoot version and exposure
• Priority on upgrading to Chatwoot version 4.17.0 or later

Technical summary

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. This vulnerability can lead to unauthorized access to conversations and contacts, and possible data exposure or tampering. Defenders should prioritize verifying exposure and upgrading to Chatwoot version 4.17.0 or later. The vulnerability has a low CVSS score of 2.3, indicating a low severity. However, defenders should still take necessary actions to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to Chatwoot version 4.17.0 or later.

Recommended defensive actions

• Verify Chatwoot version and upgrade to 4.17.0 or later if necessary
• Review and restrict access to conversations create endpoint
• Monitor for suspicious activity on Chatwoot instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Chatwoot before 4.17.0. The vulnerability allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Defenders should verify the Chatwoot version, review and restrict access to conversations create endpoint, and monitor for suspicious activity on Chatwoot instances. The CVE record was published on 2026-10-23T11:36:48.394Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.