Vulnerability Description
Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/chatwoot/chatwoot/commit/211fb1102dd208daee414cff1b8d71ea27ac
- https://github.com/chatwoot/chatwoot/pull/13878
- https://github.com/chatwoot/chatwoot/security/advisories/GHSA-8qxm-4p4p-cfhm
FAQ
What is CVE-2026-44707?
CVE-2026-44707 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enfo...
How severe is CVE-2026-44707?
CVE-2026-44707 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44707?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.