CVE-2026-72719 | Medium | 6.7 | 2026-08-10 | Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, a… |
CVE-2026-63765 | High | 8.2 | 2026-07-23 | Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitra… |
CVE-2026-44707 | Medium | 6.8 | 2026-05-26 | Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow… |
CVE-2026-44706 | High | 8.5 | 2026-05-26 | Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When fi… |
CVE-2025-12246 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoad… |
CVE-2025-12245 | Medium | 5.3 | 2025-10-27 | A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFr… |
CVE-2024-0640 | Medium | 4.8 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malici… |
CVE-2025-21628 | Critical | 9.1 | 2025-01-09 | Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from t… |
CVE-2021-3742 | High | 8.8 | 2024-11-15 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an atta… |
CVE-2021-3741 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a use… |
CVE-2021-3740 | Medium | 6.8 | 2024-11-15 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices wh… |
CVE-2023-2109 | Medium | 6.1 | 2023-04-17 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. |
CVE-2022-3741 | Critical | 9.8 | 2022-10-28 | Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources… |
CVE-2022-2901 | High | 7.1 | 2022-09-06 | Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. |
CVE-2022-0542 | Medium | 6.1 | 2022-08-19 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. |
CVE-2022-1021 | Medium | 5.4 | 2022-08-19 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. |
CVE-2022-1022 | Medium | 5.4 | 2022-04-21 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. |
CVE-2021-3813 | Medium | 6.5 | 2022-02-09 | Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2. |
CVE-2022-0527 | Medium | 6.1 | 2022-02-09 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0. |
CVE-2022-0526 | Medium | 6.1 | 2022-02-09 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0. |
CVE-2021-3649 | High | 7.5 | 2021-07-16 | chatwoot is vulnerable to Inefficient Regular Expression Complexity |