CVE-2026-72719 chatwoot CVE debrief

Who should care

Chatwoot administrators and users with account administrator privileges should assess their exposure and verify their installations to prevent potential security risks. This includes reviewing account administrator access and permissions, monitoring for potential cross-account data exposure and unauthorized configuration changes, and ensuring that Chatwoot installations are running version 4.9.0 or later.

Why it matters

CVE-2026-72719 is a medium-severity vulnerability in Chatwoot that could lead to cross-account data exposure and unauthorized configuration changes. Defenders should prioritize verifying Chatwoot installations and ensuring they are running version 4.9.0 or later.

• Potential cross-account data exposure requiring verification and monitoring
• Risk of unauthorized configuration changes necessitating review of administrator access
• Possible loss of access to transferred resources requiring inventory checks

Technical summary

The vulnerability allows authenticated account administrators to transfer sensitive resources to other accounts due to a writable account_id parameter. This could result in cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. The issue is fixed in version 4.9.0. Chatwoot administrators should assess their exposure and verify their installations to prevent potential security risks. Defenders should prioritize verifying Chatwoot installations and ensuring they are running version 4.9.0 or later to prevent potential cross-account data exposure and unauthorized configuration changes.

Defensive priority

Defenders should prioritize verifying their Chatwoot installations and ensuring they are running version 4.9.0 or later to prevent potential cross-account data exposure and unauthorized configuration changes.

Recommended defensive actions

• Verify Chatwoot installation version and upgrade to 4.9.0 or later if necessary
• Review account administrator access and permissions
• Monitor for potential cross-account data exposure and unauthorized configuration changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Chatwoot vendor has released a fixed version (4.9.0) and provided source references for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.