Vulnerability · Published Sep 16, 2026 · Assigned by VulDB

CVE-2026-92527chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in chatwoot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
n/a	chatwoot	4.17.04.17.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-405756 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery vdb-entry
VDB-405756 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-92527 | CVE Analysis and Report third-party-advisory
Submit #941600 | chatwoot <= 3.x Server-Side Request Forgery third-party-advisory
https://github.com/chatwoot/chatwoot/issues/14887 exploit, issue-tracking
https://github.com/chatwoot/chatwoot/security/advisories/GHSA-wxhm-4rjw-9m7v broken-link
https://github.com/chatwoot/chatwoot/ product