CVE-2026-44706Disclosure

LOWCVSS 8.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than operators, user-supplied values in the values field of the filter payload are interpolated directly into the SQL query without parameterization. Any authenticated user with access to an account can exploit this to execute arbitrary SQL via time-based blind injection. This affects /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions. This vulnerability is fixed in 4.11.2.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

https://github.com/chatwoot/chatwoot/security/advisories/GHSA-9pgm-75gg-6948

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-26); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hakai Offsec@HakaiOffsec127d
Disclosure
In this analysis, we explore CVE-2026-44706, a high-severity SQL injection (SQLi) vulnerability in Chatwoot. The flaw allows an attacker to execute arbitrary SQL commands against the application's database by exploiting unsanitized parameters controlled by a low-privilege user, paving the way for access to and exfiltration of sensitive data. EN: https://hakaisecurity.io/en-cve-2026-44706-sql-injection-in-chatwoot-filterservice/research-blog/
Post summary
The post announces the discovery of a high‑severity SQL injection in Chatwoot (CVE‑2026‑44706), explains the attack vector and impact, and links to an external research blog for further details.
06036133.8K
1.2K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-44706 Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering… https://www.cve.org/CVERecord?id=CVE-2026-44706
Post summary
The post announces a SQL injection flaw in Chatwoot’s APIs, providing affected versions and a brief description, but does not discuss PoC, exploitation, or remediation details.
00000207
57.5K followersView on X

Explore more

Back to dashboard