Chatwoot vulnerabilities

Products

• Chatwoot 23
• Chatwoot/chatwoot 14

Newest

• chatwoot Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id CVE-2026-115725 2.3 LowOctober 23, 2026
• chatwoot Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links CVE-2026-113355 4.8 MediumOctober 20, 2026
• chatwoot Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter CVE-2026-72719 6.7 MediumAugust 10, 2026
• chatwoot Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation CVE-2026-63765 Public exploit 8.8 HighJuly 23, 2026
• chatwoot Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts CVE-2026-44707 6.8 MediumMay 26, 2026
• chatwoot Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values CVE-2026-44706 Public exploit 8.5 HighMay 26, 2026
• chatwoot chatwoot Admin IframeLoader.vue cross site scripting CVE-2025-12246 5.3 MediumOctober 27, 2025
• chatwoot chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation CVE-2025-12245 6.9 MediumOctober 27, 2025
• chatwoot, chatwoot chatwoot/chatwoot +1 more Stored XSS in chatwoot/chatwoot CVE-2024-0640 5.6 MediumMarch 20, 2025
• chatwoot Chatwoot has a Blind SQL-injection in Conversation and Contacts filters CVE-2025-21628 9.1 CriticalJanuary 9, 2025
• chatwoot, chatwoot chatwoot/chatwoot +1 more Session Fixation in chatwoot/chatwoot CVE-2021-3740 6.8 MediumNovember 15, 2024
• chatwoot, chatwoot chatwoot/chatwoot +1 more Server-Side Request Forgery (SSRF) in chatwoot/chatwoot CVE-2021-3742 7.9 HighNovember 15, 2024
• chatwoot, chatwoot chatwoot/chatwoot +1 more Stored Cross-site Scripting (XSS) in chatwoot/chatwoot CVE-2021-3741 7.8 HighNovember 15, 2024
• chatwoot, chatwoot chatwoot/chatwoot +1 more Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot CVE-2023-2109 5.3 MediumApril 17, 2023
• chatwoot, chatwoot chatwoot/chatwoot +1 more Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot CVE-2022-3741 9.4 CriticalOctober 28, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Improper Authorization in chatwoot/chatwoot CVE-2022-2901 7.6 HighSeptember 6, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot CVE-2022-0542 8.8 HighAugust 19, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Insecure Storage of Sensitive Information in chatwoot/chatwoot CVE-2022-1021 7.6 HighAugust 19, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot CVE-2022-1022 8.1 HighApril 21, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Improper Privilege Management in chatwoot/chatwoot CVE-2021-3813 6.5 MediumFebruary 9, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot CVE-2022-0527 6.1 MediumFebruary 9, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot CVE-2022-0526 7.3 HighFebruary 9, 2022
• chatwoot, chatwoot chatwoot/chatwoot +1 more Inefficient Regular Expression Complexity in chatwoot/chatwoot CVE-2021-3649 7.5 HighJuly 16, 2021