Description

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-10T16:19:49.053Z",
  "pubdate": "2026-08-10T16:19:49.053Z",
  "executiveSummary": "An improper authorization and broken tenant isolation vulnerability exists in the Chatwoot customer engagement suite prior to version 4.9.0. The vulnerability allows authenticated account administrators to manipulate the writable account_id parameter, enabling the unauthorized transfer of sensitive platform resources—including Portals, Automation Rules, Macros, and Twilio Channels—between distinct accounts. This failure in multi-tenant boundary enforcement presents severe risk implications, including cross-account data exposure, unauthorized modification of configurations, and permanent loss of access to critical business resources for legitimate tenant owners. Exploitation of this security flaw requires authenticated access with administrative privileges within a Chatwoot tenant account, coupled with the ability to supply a targeted foreign account identifier during resource management operations. The vulnerability is fully resolved in Chatwoot version 4.9.0 through the implementation of stringent input validation and authorization checks on the account_id parameter.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient server-side authorization and multi-tenant boundary validation concerning the handling of the account_id parameter within administrative resource management endpoints. In affected versions of Chatwoot prior to 4.9.0, the application fails to adequately verify whether the authenticated administrator possesses explicit authorization to reassign specific organizational objects to alternative tenant contexts.\nThe vulnerable components include the backend routing, controller logic, and database association layers responsible for handling the creation, update, and migration of Portals, Automation Rules, Macros, and Twilio Channels. Because the application blindly trusts the writable account_id parameter supplied in the request body or parameters without enforcing strict ownership and tenancy checks, an attacker can manipulate this value to reference an arbitrary, foreign account identifier accessible within the wider database.\nThe attack flow proceeds as follows: First, an attacker authenticates to Chatwoot with valid administrator credentials on a compromised or attacker-controlled tenant account. Second, the attacker initiates an administrative action to modify, update, or transfer resources such as a Twilio Channel or an Automation Rule. Third, the attacker intercepts or crafts an HTTP request modifying the writable account_id parameter to match the identifier of a victim tenant account. Fourth, upon processing the request, the backend application reassigns the foreign key relationship in the database, transferring ownership of the targeted resource to the attacker's account while simultaneously stripping access from the legitimate tenant.\nThe post-exploitation impact includes severe breaches of tenant isolation, unauthorized access to telecommunications infrastructure via hijacked Twilio Channels, exposure of confidential knowledge bases through transferred Portals, and operational disruption via unauthorized modifications to Macros and Automation Rules."
}