The vulnerability is an authentication bypass in Chatwoot's direct uploads controller. Missing authentication checks allow attackers to create arbitrary ActiveStorage blobs under any tenant account. By resolving account identifiers and obtaining signed PUT URLs, an attacker can upload any data, including malicious payloads, to the application’s storage backend. This privilege could lead to data exfiltration, persistence of malware, or serve as a vector for later exploitation.

Chatwoot 4.15 and earlier releases across all tenants and environments.

The flaw is rated a CVSS score of 8.8, indicating a high severity issue. The EPSS score is less than 1%, suggesting a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the vulnerability is exploitable remotely over the network via the unauthenticated /direct_uploads endpoint. An attacker can locate or brute‑force tenant identifiers, obtain signed PUT URLs, and upload arbitrary data, potentially enabling further compromise.