PT-2026-43348 · Chatwoot · Chatwoot

Tenbbughunters + 1 · CVE-2026-44706 · Published 2026-05-26 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chatwoot versions 2.2.0 through 4.11.1

Description An issue exists in the conversation and contact filter APIs where user-supplied values in the values field of the filter payload are interpolated directly into SQL queries without parameterization when filtering by custom attributes of type date or number using the is greater than or is less than operators. This allows an authenticated user with account access to execute arbitrary SQL via time-based blind injection. Affected endpoints include '/api/v1/accounts/{account id}/conversations/filter', '/api/v1/accounts/{account id}/contacts/filter', and '/api/v1/accounts/{account id}/custom attribute definitions'.

Recommendations Update to version 4.11.2.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44706

GHSA-9PGM-75GG-6948

Affected Products

Chatwoot

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44706.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44706 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44706 · Vendor Advisory
• https://github.com/chatwoot/chatwoot/security/advisories/GHSA-9pgm-75gg-6948 · Note
• https://twitter.com/CVEnew/status/2059337191252255150 · Twitter Post
• https://twitter.com/HakaiOffsec/status/2062990261446119729 · Twitter Post