Executive brief
Chatwoot is a customer engagement platform used by businesses to manage communications with their clients. A security flaw in the platform's filtering system allows an authorized user to bypass security boundaries and access sensitive information belonging to other accounts. This could lead to the theft of customer data, private conversation logs, user email addresses, and encrypted password hashes.
Technical details
A SQL injection vulnerability exists in Chatwoot's conversation and contact filter APIs due to improper parameterization of user-supplied values. When filtering by custom attributes of type 'date' or 'number' using 'is_greater_than' or 'is_less_than' operators, input is interpolated directly into SQL queries. Additionally, the 'attribute_key' field in custom attribute definitions was found to be vulnerable to injection. An authenticated attacker with low privileges can utilize time-based blind SQL injection to exfiltrate data across tenant boundaries, including bcrypt password hashes and API tokens. The vulnerability is fixed in version 4.11.2 by enforcing strict attribute key formats and using 'sanitize_sql_array' for bind parameters.
Affected products
- Chatwoot Chatwoot 2.2.0 to 4.11.1
Timeline
- 2026-05-05: advisory: GitHub advisory published by maintainers
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fix released in version 4.11.2