CVE-2026-72719
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Chatwoot prior to version 4.9.0 allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources.
Risk Assessment
Breaking tenant isolation may lead to customer data leakage, unauthorized changes, and operational disruption.
Recommendation
Update Chatwoot to version 4.9.0.
Original NVD description (English source)
Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.