medium6.7
CVE-2026-72719
Chatwoot is a customer engagement suite.
Impact
Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.
Affected products
| Product | Affected versions |
|---|---|
| Chatwoot Is A Customer Engagement Suite. | before 4.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.