Server-Side Request Forgery in Chatwoot Webhook API

CVE-2026-5205

What is CVE-2026-5205?

A vulnerability has been detected in Chatwoot's Webhook API, specifically in the Webhooks::Trigger function located in lib/webhooks/trigger.rb. This flaw is due to improper handling of the URL argument, which makes it susceptible to server-side request forgery. An attacker can exploit this vulnerability remotely, potentially leading to unauthorized access to internal services or resources. The exploit code is publicly available, intensifying the risk for users. Despite efforts to notify the vendor prior to disclosure, there has been no response.

References