Executive brief
Chatwoot, an open-source customer engagement platform, contains a vulnerability in its webhook system. An attacker can exploit this to force the server to make unauthorized requests to internal or external systems. This could lead to the exposure of internal network information or unauthorized access to internal services that are not intended to be public.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Chatwoot up to version 4.11.2 within the Webhook API component. The flaw is located in the Webhooks::Trigger function in lib/webhooks/trigger.rb, where the 'url' argument is not properly validated. A remote attacker with low privileges can manipulate this argument to force the server to initiate requests to arbitrary destinations. This can be used to scan internal networks, access metadata services, or interact with internal APIs. A public exploit is reportedly available, and as of the advisory date, the vendor has not provided a patch.
Affected products
- Chatwoot Chatwoot up to 4.11.2
Timeline
- 2026-03-31: disclosed: Vulnerability disclosed by VulDB
- 2026-03-31: advisory: NVD published CVE-2026-5205