Cross-Account Data Exposure and Configuration Issues in Chatwoot by Chatwoot

CVE-2026-72719

What is CVE-2026-72719?

Prior to version 4.9.0, Chatwoot, a customer engagement suite, had a significant security flaw where authenticated account administrators could inadvertently transfer critical components such as Portals, Automation Rules, Macros, and Twilio Channels to other accounts through manipulation of the writable account_id parameter. This vulnerability compromised tenant isolation and led to the risk of unauthorized data exposure, erroneous configuration changes, or loss of access to crucial resources. Version 4.9.0 addresses this issue with essential security patches.

References