CVE-2026-72719

Published: Aug 10, 2026Modified: Aug 13, 2026

6.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Exploitability: 1.2 / Impact: 5.5

Source: security-advisories@github.com (Secondary)

Description

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.

Related CWEs

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (4)

https://github.com/chatwoot/chatwoot/commit/86da3f7c069f8ed6dce2576e1a760ca72b6f40fd

Source: security-advisories@github.com

https://github.com/chatwoot/chatwoot/pull/13116

Source: security-advisories@github.com

https://github.com/chatwoot/chatwoot/releases/tag/v4.9.0

Source: security-advisories@github.com

https://github.com/chatwoot/chatwoot/security/advisories/GHSA-x288-jh8j-348c

Source: security-advisories@github.com

Timeline

No history available yet.