CVE-2026-92527

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92527

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92527.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92527

Aliases

GHSA-wxhm-4rjw-9m7v

Published

2026-09-16T20:15:09Z

Modified

2026-09-19T03:30:17Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery

Details

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92527.json"
}

References

Affected packages

Git / github.com/chatwoot/chatwoot

Affected ranges

Type

GIT

Repo

https://github.com/chatwoot/chatwoot

Events

Introduced

b34f5b71a4d7f41fa87cf2b32260e2c887817e54

Last Affected

b354a9550e1fb59fa537a9c384232cb076213e72

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.17.0"
        },
        {
            "last_affected": "4.17.0"
        },
        {
            "introduced": "4.17.1"
        },
        {
            "last_affected": "4.17.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.17.0

4.17.1

v4.*

v4.17.0

v4.17.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92527.json"