CVE-2026-72719Disclosure

LOWCVSS 6.7 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-915

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-72719 Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twil… https://www.cve.org/CVERecord?id=CVE-2026-72719 ----- Traducción: CVE-2026-72719 Cha… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-72719 in Chatwoot, describing that prior to version 4.9.0, authenticated admins could transfer several key objects, and indicates the issue was fixed in that version. No PoC or exploit evidence is provided.
0000036
98 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-72719 Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twil… https://www.cve.org/CVERecord?id=CVE-2026-72719
Post summary
The post reports that, in Chatwoot versions before 4.9.0, authenticated administrators could transfer sensitive components, highlighting an issue likely tied to improper access controls in the platform.
000001.4K
57.9K followersView on X

Explore more

Back to dashboard