SQL injection in Chatwoot - CVE-2026-44706
Published: May 5, 2026
Vulnerability identifier: #VU130051
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44706
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to SQL injection in the conversation and contact filter APIs when processing filter requests that use custom attributes. A remote user can send a specially crafted filter payload to disclose sensitive information.
If no date or number custom attribute exists, one can be created through the custom attribute definitions endpoint, making the precondition trivial to satisfy.
Affected software
Chatwoot
How to mitigate CVE-2026-44706
Install security update from vendor's website.
Chatwoot - update to 4.11.2