CVE-2026-115725

Name of the Vulnerable Software and Affected Versions Chatwoot versions prior to 4.17.0

Description An authorization bypass allows authenticated agent bots to access other accounts by providing a foreign contact inbox source id. This is achieved by calling the 'conversations create' endpoint with a source id belonging to another account, enabling the creation or retrieval of conversations and the posting of messages to that account's contacts.

Recommendations Update to version 4.17.0 or later.