{"id":"CVE-2026-115725","title":"Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id","summary":"Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"chatwoot","product":"chatwoot","affected":["chatwoot < 4.17.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:36:48.394Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115725","references":[{"url":"https://github.com/chatwoot/chatwoot/pull/15521"},{"url":"https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd"},{"url":"https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0","label":"chatwoot v4.17.0 Release Notes"},{"url":"https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213"},{"url":"https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27"},{"url":"https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id","label":"VulnCheck Advisory: Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.585Z","slug":"CVE-2026-115725","body":"## Overview\n\nChatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.\n\n## Affected\n\n- `chatwoot < 4.17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}