PT-2026-43349 · Chatwoot · Chatwoot

Dishantchavda · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-44707

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chatwoot versions 2.14.0 through 4.12.x

Description A Pre-Account Takeover (Pre-ATO) issue exists in the authentication flow. Because email confirmation is not enforced before an account becomes usable, an attacker can pre-register an email address they do not own and set a password. If the legitimate owner of that email later signs in using Google OAuth or another OmniAuth provider, the OAuth flow silently confirms the existing account without invalidating the attacker's pre-set credentials. This allows the attacker to log in with their chosen password and access sensitive data entered by the victim, such as personally identifiable information (PII) and API keys.

Recommendations Update to version 4.13.0.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-283

Related Identifiers

CVE-2026-44707

Affected Products

Chatwoot

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44707 · Security Note
• https://github.com/chatwoot/chatwoot/security/advisories/GHSA-8qxm-4p4p-cfhm · Note
• https://github.com/chatwoot/chatwoot/commit/211fb1102dd208daee414cff1b8d71ea27ac5ebf · Note
• https://github.com/chatwoot/chatwoot/pull/13878 · Note
• https://twitter.com/CVEnew/status/2059337188026855449 · Twitter Post