CVE-2026-63765

Published: Lug 23, 2026 Last Modified: Lug 27, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 8,2
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: low

Description

AI Translation Available

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

306

Missing Authentication for Critical Function

Draft
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Cloud Computing, ICS/OT
View CWE Details
https://github.com/chatwoot/chatwoot/commit/8dd0d08322edafaec24624b72ed2f604592…
https://github.com/chatwoot/chatwoot/issues/15072
https://github.com/chatwoot/chatwoot/pull/15039
https://github.com/chatwoot/chatwoot/releases/tag/v4.16.0
https://www.vulncheck.com/advisories/chatwoot-unauthenticated-activestorage-dir…