CVE-2026-72719: Chatwoot Information Disclosure Flaw

CVE-2026-72719 Overview

CVE-2026-72719 affects Chatwoot, an open-source customer engagement suite used by organizations to manage multi-channel customer conversations. Versions prior to 4.9.0 accepted a writable account_id parameter on several administrative endpoints. Authenticated account administrators could exploit this to transfer Portals, Automation Rules, Macros, and Twilio Channels from their tenant to another account. The flaw breaks multi-tenant isolation and enables cross-account data exposure and unauthorized configuration changes. Chatwoot resolved the issue in version 4.9.0 by removing account_id from permitted parameters. The weakness is categorized under CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes.

Critical Impact
A malicious or compromised administrator on one Chatwoot tenant can move resources into other tenants, breaking isolation guarantees in shared or SaaS deployments.

Affected Products

Chatwoot versions prior to 4.9.0
Chatwoot self-hosted deployments serving multiple tenants
Chatwoot SaaS environments where account administrators are not fully trusted

Discovery Timeline

2026-08-10 - CVE-2026-72719 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72719

Vulnerability Analysis

Chatwoot exposes administrative REST endpoints for managing Portals, Automation Rules, Macros, and Twilio Channels. Each of these controllers accepts a JSON body that is filtered through a Rails strong parameters allowlist. The affected controllers included :account_id in that allowlist. When an administrator submitted a create or update request, the value of account_id was written directly to the record. This bypassed the tenant scoping applied by the current session and reassigned the resource to a different account. Because the controllers assumed account_id would be derived from the authenticated session, downstream authorization checks did not detect the reassignment.

Root Cause

The root cause is a mass-assignment issue mapped to [CWE-915]. The strong parameter method automation_rules_permit and its equivalents allowed a client-supplied account_id to overwrite the server-controlled tenant identifier on the underlying ActiveRecord object. Similar patterns existed in the controllers handling Portals, Macros, and Twilio Channels.

Attack Vector

Exploitation requires an authenticated account administrator. The attacker sends a crafted HTTP request to one of the affected endpoints and sets account_id to a target tenant. On success, the resource is created or updated under the target account. The attacker can also transfer existing resources out of a legitimate account, causing loss of access for the original owner.

ruby

# Patched controller: app/controllers/api/v1/accounts/automation_rules_controller.rb
# Source: https://github.com/chatwoot/chatwoot/commit/86da3f7c069f8ed6dce2576e1a760ca72b6f40fd

def automation_rules_permit
  params.permit(
-    :name, :description, :event_name, :account_id, :active,
+    :name, :description, :event_name, :active,
    conditions: [:attribute_key, :filter_operator, :query_operator, :custom_attribute_type, { values: [] }],
    actions: [:action_name, { action_params: [] }]
  )
end

The patch removes :account_id from the permitted parameters list. The tenant identifier is now derived exclusively from the authenticated session context. See the upstream commit and pull request #13116 for the full change set.

Detection Methods for CVE-2026-72719

Indicators of Compromise

HTTP requests to /api/v1/accounts/{id}/automation_rules, /portals, /macros, or Twilio channel endpoints containing an account_id field in the JSON body
Audit log entries showing Portals, Automation Rules, Macros, or Twilio Channels whose account_id differs from the acting administrator's session tenant
Sudden disappearance of automation rules, macros, or channel configurations from a tenant's admin console

Detection Strategies

Enable HTTP request body logging on the Chatwoot Rails application and alert on any authenticated request that contains an account_id parameter targeting the affected controllers
Run database consistency queries that compare the account_id of Portals, Automation Rules, Macros, and Channels against the account that originally created them
Correlate administrator authentication events with resource creation and modification events across account boundaries

Monitoring Recommendations

Forward Chatwoot application logs and web server access logs to a centralized logging platform for retention and correlation
Alert on privileged administrator activity that touches multiple account_id values within a short window
Baseline the normal rate of Portal, Macro, and Automation Rule changes per tenant and flag statistical anomalies

How to Mitigate CVE-2026-72719

Immediate Actions Required

Upgrade Chatwoot to version 4.9.0 or later on all self-hosted deployments
Audit Portals, Automation Rules, Macros, and Twilio Channels across every tenant and reassign any resources whose account_id was changed without authorization
Rotate Twilio credentials associated with any channel that may have been transferred to an untrusted tenant
Review administrator account inventory and revoke access for accounts that are no longer required

Patch Information

The fix is included in Chatwoot v4.9.0. The patch, tracked in pull request #13116, removes account_id from strong parameter allowlists in the affected controllers. Additional details are available in GitHub Security Advisory GHSA-x288-jh8j-348c.

Workarounds

If immediate upgrade is not possible, restrict administrative endpoints behind a reverse proxy rule that rejects requests containing an account_id field in the JSON body for the affected controllers
Reduce the number of account administrators and enforce multi-factor authentication on all administrator sessions
Segment high-value tenants onto dedicated Chatwoot instances until the upgrade is completed

bash

# Example NGINX rule to block requests containing account_id in the JSON body
# for the affected Chatwoot controllers until the upgrade is applied.
location ~ ^/api/v1/accounts/[0-9]+/(automation_rules|portals|macros|channels/twilio) {
    if ($request_method ~ ^(POST|PUT|PATCH)$) {
        access_by_lua_block {
            ngx.req.read_body()
            local body = ngx.req.get_body_data() or ""
            if body:find('"account_id"') then
                ngx.exit(400)
            end
        }
    }
    proxy_pass http://chatwoot_upstream;
}