CVE-2026-44706 Overview
CVE-2026-44706 is a SQL injection vulnerability in Chatwoot, an open-source customer engagement suite. The flaw affects versions from 2.2.0 to before 4.11.2 and resides in the conversation and contact filter APIs. When users filter by a custom attribute of type date or number with the is_greater_than or is_less_than operators, the application interpolates user-supplied values directly into the SQL query without parameterization. Any authenticated user with account access can exploit this to execute arbitrary SQL through time-based blind injection. The issue is tracked under [CWE-89] and fixed in version 4.11.2.
Critical Impact
Authenticated attackers can extract arbitrary database contents through time-based blind SQL injection against three filter endpoints, exposing customer conversations, contact data, and account secrets.
Affected Products
- Chatwoot versions 2.2.0 through 4.11.1
- Chatwoot self-hosted deployments exposing the filter APIs
- Chatwoot cloud tenants prior to the 4.11.2 patch
Discovery Timeline
- 2026-05-26 - CVE-2026-44706 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-44706
Vulnerability Analysis
The vulnerability exists in three Chatwoot endpoints: /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions. These endpoints accept JSON filter payloads describing how to query conversations or contacts. When a filter targets a custom attribute defined as a date or number, Chatwoot builds a SQL fragment using the comparison operator and the supplied value.
For the is_greater_than and is_less_than operators, the value from the request body is concatenated into the raw SQL string rather than bound as a parameter. The database engine therefore parses attacker-controlled text as SQL syntax. An authenticated user can deliver payloads that trigger conditional delays, enabling time-based blind extraction of arbitrary data.
Root Cause
The root cause is missing parameterization in the filter query builder. The code path for numeric and date custom attributes interpolates the values field directly into the generated query string. Parameter binding is the standard defense against [CWE-89] SQL injection, and its absence allows operator-adjacent input to escape the intended literal context.
Attack Vector
Exploitation requires only a valid account session, which any authenticated tenant user satisfies. The attacker submits a POST request to one of the affected filter endpoints with a payload that defines a custom attribute filter using is_greater_than or is_less_than. The values element contains a crafted SQL fragment such as a CASE expression combined with pg_sleep to induce measurable response delays. Repeating this technique character by character reconstructs sensitive table contents without any direct data echo.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-44706
Indicators of Compromise
- POST requests to /api/v1/accounts/{account_id}/conversations/filter or /api/v1/accounts/{account_id}/contacts/filter containing is_greater_than or is_less_than operators paired with non-numeric values payloads.
- Database logs showing pg_sleep, CASE WHEN, or SUBSTRING constructs originating from the Chatwoot application user.
- Unusually long response times on filter endpoints from a single authenticated session.
- Repeated filter API calls from the same account user within short intervals, consistent with blind extraction loops.
Detection Strategies
- Inspect application logs for filter payloads where the values field contains SQL keywords, parentheses, or quote characters.
- Enable PostgreSQL log_min_duration_statement to capture slow queries originating from filter endpoints.
- Correlate authenticated API session IDs with anomalous filter request volume and latency.
Monitoring Recommendations
- Alert on any filter API request whose body length or special-character density exceeds a baseline for legitimate UI traffic.
- Monitor PostgreSQL for executions of pg_sleep or other time-delay functions invoked through the Chatwoot service account.
- Track HTTP 5xx and timeout rates on the affected endpoints to surface failed injection attempts.
How to Mitigate CVE-2026-44706
Immediate Actions Required
- Upgrade Chatwoot to version 4.11.2 or later on all self-hosted instances.
- Audit account user lists and revoke access for inactive or untrusted authenticated users until patching completes.
- Review historical access logs for the three affected endpoints to identify prior exploitation attempts.
- Rotate API tokens and database credentials if exploitation indicators are present.
Patch Information
The Chatwoot maintainers fixed CVE-2026-44706 in release 4.11.2 by parameterizing user-supplied values in the custom attribute filter query builder. Details are available in the GitHub Security Advisory GHSA-9pgm-75gg-6948.
Workarounds
- If immediate upgrade is not possible, restrict access to the conversation, contact, and custom attribute filter endpoints at the reverse proxy layer.
- Deploy a web application firewall rule that blocks filter payloads containing SQL metacharacters in the values field for is_greater_than and is_less_than operators.
- Disable creation and use of date and number custom attributes until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
