Read the docs
TI-2026-32593 Aliases CVE-2026-44706

Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values

Priority LOW 36CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than operators, user-supplied values in the values field of the filter payload are interpolated directly into the SQL query without parameterization. Any authenticated user with access to an account can exploit this to execute arbitrary SQL via time-based blind injection. This affects /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions. This vulnerability is fixed in 4.11.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed chatwoot (chatwoot): 4.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chatwootchatwoot2.2.0 to before 4.11.24.11.2Patch availableCNA
  • chatwoot Vendorchatwoot Affected 2.2.0 to before 4.11.2 Fixed in 4.11.2 Patch available CNA

Remediation

  • Fix · CNA chatwoot (chatwoot) Fixed in 4.11.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44706

References

Other 1

  • TI-2026-45352 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation CVSS 4.0HIGH 8.8
  • TI-2022-03436 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot CVSS 3.1CRITICAL 9.8
  • TI-2023-01984 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot CVSS 3.1MEDIUM 6.1
  • TI-2025-11229 chatwoot Admin IframeLoader.vue cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2024-00591 Stored XSS in chatwoot/chatwoot CVSS 3.1MEDIUM 4.8
  • TI-2025-15587 Chatwoot has a Blind SQL-injection in Conversation and Contacts filters CVSS 3.1CRITICAL 9.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences