CVE-2026-44706: Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the isgreaterthan or islessthan operators, user-supplied values in the values field of the filter payload are interpolated directly into the SQL query without parameterization. Any authenticated user with access to an account can exploit this to execute arbitrary SQL via time-based blind injection. This affects /api/v1/accounts/{accountid}/conversations/filter, /api/v1/accounts/{accountid}/contacts/filter, and /api/v1/accounts/{accountid}/customattributedefinitions. This vulnerability is fixed in 4.11.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chatwootto a version that resolves this vulnerability.Fixed in 4.11.2 - Compensating control
If you cannot upgrade to 4.11.2 immediately, restrict access to the affected authenticated APIs (/api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions) so that only trusted users can reach them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44706?
The severity of CVE-2026-44706 is rated as high with a score of 8.5.
How do I fix CVE-2026-44706?
To fix CVE-2026-44706, upgrade Chatwoot to version 4.11.2 or later, where the vulnerability has been addressed.
What types of attacks can CVE-2026-44706 facilitate?
CVE-2026-44706 can facilitate SQL injection attacks through the Conversation/Contact Filter API by exploiting user-supplied attribute values.
What versions of Chatwoot are affected by CVE-2026-44706?
Chatwoot versions from 2.2.0 to before 4.11.2 are affected by CVE-2026-44706.
What are the potential impacts of exploiting CVE-2026-44706?
Exploiting CVE-2026-44706 could lead to unauthorized data access, potentially allowing attackers to read sensitive information from the database.