Read the docs
TI-2026-32594 Aliases CVE-2026-44707

Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

Priority LOW 32CWE-283Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed chatwoot (chatwoot): 4.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chatwootchatwoot2.14.0 to before 4.13.04.13.0Patch availableCNA
  • chatwoot Vendorchatwoot Affected 2.14.0 to before 4.13.0 Fixed in 4.13.0 Patch available CNA

Remediation

  • Fix · CNA chatwoot (chatwoot) Fixed in 4.13.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44707

References

Other 3

  • TI-2026-45352 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation CVSS 4.0HIGH 8.8
  • TI-2022-03436 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot CVSS 3.1CRITICAL 9.8
  • TI-2023-01984 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot CVSS 3.1MEDIUM 6.1
  • TI-2025-11229 chatwoot Admin IframeLoader.vue cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2024-00591 Stored XSS in chatwoot/chatwoot CVSS 3.1MEDIUM 4.8
  • TI-2025-15587 Chatwoot has a Blind SQL-injection in Conversation and Contacts filters CVSS 3.1CRITICAL 9.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences