CVE-2026-72719CWE-915

CVE-2026-72719

Medium · published August 10, 2026

CVSS v3.1
6.7
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-08-10T20:19Z
References (4)
https://github.com/chatwoot/chatwoot/commit/86da3f7c069f8ed6dce2576e1a760ca72b6f40fd · [email protected]https://github.com/chatwoot/chatwoot/pull/13116 · [email protected]https://github.com/chatwoot/chatwoot/releases/tag/v4.9.0 · [email protected]https://github.com/chatwoot/chatwoot/security/advisories/GHSA-x288-jh8j-348c · [email protected]
EPSS history
Timeline
  • 10 AUG 15:38Z
    Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter
    cvelistv5