CVE-2026-63765: Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chatwootto a version that resolves this vulnerability.Fixed in 4.16.0 - Compensating control
Restrict direct access to the Chatwoot direct uploads controller endpoints (e.g., via firewall/ingress rules) until the instance is upgraded to 4.16.0, to limit unauthenticated exploitation.
- Operational
After upgrading, review and remediate any malicious ActiveStorage blobs created in tenant accounts due to the authentication bypass (e.g., investigate and remove unauthorized blobs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63765?
CVE-2026-63765 has a high severity rating of 8.2.
How do I fix CVE-2026-63765?
To fix CVE-2026-63765, upgrade to Chatwoot version 4.16.0 or later.
What type of vulnerability is represented by CVE-2026-63765?
CVE-2026-63765 is an authentication bypass vulnerability that allows unauthenticated users to create arbitrary ActiveStorage blobs.
What systems are affected by CVE-2026-63765?
CVE-2026-63765 affects Chatwoot versions prior to 4.16.0.
What can attackers do with CVE-2026-63765?
Attackers can exploit CVE-2026-63765 to create arbitrary blobs in any tenant account without authentication.