Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-63765Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

High 8.2

In plain English

A high-severity missing authentication in chatwoot from chatwoot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

Affected products (as reported)

Vendor	Product	Versions
chatwoot	chatwoot	0 – before 4.16.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

Researcher Disclosure technical-description, exploit, issue-tracking
Chatwoot 4.16.0 Release Notes release-notes, patch
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/chatwoot-unauthenticated-activestorage-direct-upload-arbitrary-blob-creation third-party-advisory