Skip to content
Threat Feed
Subscribe

Vendor

Chatwoot

2 briefs RSS
high advisory

SQL Injection in Chatwoot FilterService

An authenticated SQL injection vulnerability (CVE-2026-44706) in Chatwoot versions 4.11.1 and earlier allows attackers to perform unauthorized database queries and exfiltrate sensitive data.

Chatwoot
1r 2t 1c
high advisory

CVE-2026-63765: Chatwoot Authentication Bypass Vulnerability in Direct Uploads Controller

Chatwoot before version 4.16.0 contains an authentication bypass vulnerability in its direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks, leading to data manipulation.

Chatwoot < 4.16.0 authentication-bypass web-application vulnerability cve
1r 2t 1c