PT-2026-121837
CVE-2026-115725
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
4.2
MediumMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source id. Attackers can call the conversations create endpoint with another account's source id to create or retrieve conversations and post messages to that account's contacts.
Found an issue in the description? Have something to add? Feel free to write us 👾