CVE-2026-63765: Chatwoot Authentication Bypass Vulnerability in Direct Uploads Controller

A critical authentication bypass vulnerability, identified as CVE-2026-63765, has been discovered in Chatwoot versions prior to 4.16.0. This flaw resides within the application's direct uploads controller, a component responsible for managing file uploads to the ActiveStorage backend. Unauthenticated attackers can exploit this vulnerability by bypassing intended security checks to resolve any tenant account and conversation data without authorization. Subsequently, these attackers can obtain signed PUT URLs, typically reserved for authenticated users, which enable them to write arbitrary data as ActiveStorage blobs to the application's storage backend. This exposure allows for unauthorized data creation, modification, or deletion, posing a significant risk to data integrity and availability across affected Chatwoot instances.

Attack Chain

1. An unauthenticated attacker identifies a vulnerable Chatwoot instance running a version older than 4.16.0.
2. The attacker initiates a request to the application's direct uploads controller, bypassing the expected authentication mechanisms.
3. Leveraging the missing authentication checks (CWE-306) within the controller, the attacker successfully gains unauthorized access to internal application functions.
4. The attacker exploits this bypass to resolve or retrieve sensitive information about any tenant account and conversation.
5. Through the compromised controller, the attacker obtains signed PUT URLs, which are normally issued for legitimate, authenticated file upload operations.
6. Using the acquired signed PUT URLs, the attacker sends PUT requests containing arbitrary data.
7. This malicious data is then written as ActiveStorage blobs to the application's backend storage.
8. The final objective is unauthorized data creation, modification, or corruption within targeted Chatwoot tenant accounts, impacting integrity and availability.

Impact

The successful exploitation of CVE-2026-63765 allows unauthenticated attackers to perform unauthorized data operations across any tenant account within a vulnerable Chatwoot instance. Attackers can create, modify, or potentially corrupt arbitrary ActiveStorage blobs by writing malicious data to the application's storage backend. While the NVD advisory does not specify observed victim counts or targeted sectors, the nature of the vulnerability could lead to widespread data integrity issues, service disruption, or reputational damage for any organization using affected Chatwoot versions, as sensitive customer conversation data could be manipulated.

Recommendation

• Patch CVE-2026-63765 by upgrading all Chatwoot instances to version 4.16.0 or newer immediately.
• Deploy the Sigma rule "Detect CVE-2026-63765 Exploitation - Chatwoot Unauthenticated Direct Upload Access" to your SIEM and monitor for suspicious POST requests to the direct uploads controller.
• Enable comprehensive web server logging for HTTP methods, URI stems, and response statuses to capture activity related to the direct uploads controller.