---
id: CVE-2026-63765
title: >-
  Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the
  direct uploads controller that allows unauthenticated attackers to create
  arbitrary ActiveStorage blobs in any tenant account
summary: >-
  Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the
  direct uploads controller that allows unauthenticated attackers to create
  arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit
  missing au…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-306
vendor: chatwoot
product: chatwoot
affected:
  - chatwoot < 4.16.0
published: '2026-07-23'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:16:57.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63765'
references:
  - url: >-
      https://github.com/chatwoot/chatwoot/commit/8dd0d08322edafaec24624b72ed2f6045921cb7b
    label: disclosure@vulncheck.com
  - url: 'https://github.com/chatwoot/chatwoot/issues/15072'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/chatwoot/chatwoot/pull/15039'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/chatwoot/chatwoot/releases/tag/v4.16.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/chatwoot-unauthenticated-activestorage-direct-upload-arbitrary-blob-creation
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-27T15:52:33.264514Z'
epss: 0.00703
epssPercentile: 0.51259
ingestedAt: '2026-09-17T18:25:15.980Z'
---

## Overview

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.