---
id: CVE-2026-115725
title: Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
summary: >-
  Chatwoot before 4.17.0 contains an authorization bypass vulnerability that
  allows authenticated agent bots to access other accounts by supplying a
  foreign contact inbox source_id. Attackers can call the conversations create
  endpoint with…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: chatwoot
product: chatwoot
affected:
  - chatwoot < 4.17.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:36:48.394Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115725'
references:
  - url: 'https://github.com/chatwoot/chatwoot/pull/15521'
  - url: >-
      https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd
  - url: 'https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0'
    label: chatwoot v4.17.0 Release Notes
  - url: >-
      https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213
  - url: >-
      https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27
  - url: >-
      https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id
    label: >-
      VulnCheck Advisory: Chatwoot before 4.17.0 Cross-Account Authorization
      Bypass via source_id
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.585Z'
---

## Overview

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.

## Affected

- `chatwoot < 4.17.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.