Chatwoot vulnerabilities
We track 5 vulnerabilities in Chatwoot products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest Chatwoot vulnerabilities
- 8.2 High severity
chatwoot: Missing Authentication for Critical Functionality
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to
- 8.5 High severity
chatwoot: Improper Neutralization of Special Elements used in an SQL Command
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than operat
- 7.3 High severity
chatwoot: Incorrect Privilege Assignment
A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper auth
- 8.8 High severity
chatwoot: Improper Neutralization of Special Elements used in an SQL Command
Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitra
- 9.8 Critical severity
chatwoot/chatwoot: Improper Restriction of Excessive Authentication Attempts
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however,