Priority HIGH 77
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00481 · Published 2026-07-23 · Fixed in 4.16.0 CWE-306
Priority HIGH 75
Impact varies for each individual vulnerability in the application.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01231 · Published 2022-10-28 · Fixed in v2.10.0 CWE-307
Priority MEDIUM 60
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00366 · Published 2023-04-17 · Fixed in 2.14.0 CWE-79
Priority MEDIUM 57
A security flaw has been discovered in chatwoot up to 4.7.0.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00407 · Published 2025-10-27 · No fix listed CWE-79
Priority MEDIUM 57
A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00269 · Published 2025-03-20 · Fixed in 3.5.2 CWE-79
Priority MEDIUM 40
Chatwoot is a customer engagement suite.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.00692 · Published 2025-01-09 · Fixed in 3.16.0 CWE-89
Priority MEDIUM 40
A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00397 · Published 2024-11-15 · Fixed in 2.5.0 CWE-918
Priority LOW 36
Chatwoot is a customer engagement suite.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00227 · Published 2026-05-26 · Fixed in 4.11.2 CWE-89
Priority LOW 35
chatwoot is vulnerable to Inefficient Regular Expression Complexity
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01222 · Published 2021-07-16 · No fix listed CWE-1333
Priority LOW 32
Chatwoot is a customer engagement suite.
CVSS 3.1MEDIUM 6.7· Network · High privileges · No interaction · EPSS 0.00575 · Published 2026-08-10 · Fixed in 4.9.0 CWE-915
Priority LOW 32
Chatwoot is a customer engagement suite.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00344 · Published 2026-05-26 · Fixed in 4.13.0 CWE-283
Priority LOW 32
A vulnerability was identified in chatwoot up to 4.7.0.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00325 · Published 2025-10-27 · No fix listed CWE-345
Priority LOW 32
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00639 · Published 2022-09-06 · Fixed in 2.8 CWE-285
Priority LOW 32
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.04499 · Published 2022-04-21 · Fixed in 2.5.0 CWE-79
Priority LOW 31
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01086 · Published 2022-02-09 · Fixed in v2.2 CWE-269
Priority LOW 31
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0.
CVSS 3.1MEDIUM 6.8· Adjacent network · Low privileges · User interaction · EPSS 0.00209 · Published 2024-11-15 · Fixed in 2.4.0 CWE-384
Priority LOW 29
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00998 · Published 2022-08-19 · Fixed in 2.7.0 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0085 · Published 2022-02-09 · Fixed in 2.2.0 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00856 · Published 2022-02-09 · Fixed in 2.2.0 CWE-79
Priority LOW 26
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00778 · Published 2022-08-19 · Fixed in 2.6.0 CWE-922
Priority LOW 24
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00301 · Published 2024-11-15 · Fixed in 2.6 CWE-79
Priority LOW 21
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00229 · Published 2026-10-20 · Fixed in 4.14.0 CWE-79
Priority LOW 12
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.0024 · Published 2026-10-23 · Fixed in 4.17.0 CWE-639
THREATIST.IORead the docs