CVE-2026-63765: Authentication Bypass in Chatwoot

Chatwoot before 4.16.0: authentication bypass in direct uploads controller enables arbitrary storage writes.

CVE-2026-63765 identifies an authentication bypass in the direct uploads controller of Chatwoot versions prior to 4.16.0. The vulnerability allows unauthenticated attackers to completely bypass authentication controls, resolving any account and conversation in the system. This enables obtaining signed PUT URLs to write arbitrary data directly to storage backends (ActiveStorage), compromising file integrity across all tenants.

The vulnerability has a CVSS score of 8.2, classified as high. It was published on NVD on July 23, 2026. A critical and recent development: since November 1, 2026, public proof-of-concept exploit code is available in repositories. This means the threat is no longer theoretical but active and verifiable.

Immediately verify which version of Chatwoot runs in your production environments. If below 4.16.0, initiate updates without delay. In parallel, review access logs for the direct uploads controller over the past months to detect unauthorized access, anomalous blob creation patterns, or unusual data transfers. If you find suspicious activity, isolate and inspect files written to storage.

At a glance

What: Authentication bypass in direct uploads controller of Chatwoot before 4.16.0. Unauthenticated attackers resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to ActiveStorage backend.
Severity: CVSS 8.2 (high). Unauthorized access to any tenant's data and modifications to storage backend.
Affected versions: Chatwoot versions prior to 4.16.0
Fix: Update to Chatwoot 4.16.0 or later
Status: CVE published July 23, 2026; PoC exploit publicly available since November 1, 2026
Action: Check Chatwoot version in production. If before 4.16.0, upgrade immediately. Review direct uploads controller logs for suspicious access.

Sources: NVD, CVE-2026-63765

← All articles