CVE-2026-92527

Overview

Chatwoot versions up to 4.17.1 contain a server‑side request forgery (SSRF) flaw in the Shopify OAuth callbacks controller. An attacker can trigger the server to make arbitrary outbound HTTP requests, potentially accessing internal resources or exfiltrating data.

Description

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Impact

An attacker can force the Chatwoot server to send requests to any URL, including internal network services, exposing sensitive data or enabling further lateral movement. The confidentiality of internal resources is at risk, and integrity could be compromised if the server performs unintended actions.

Remediation

['Upgrade Chatwoot to the latest released version (≥4.17.2) once the vendor releases a patch.', 'If upgrading is not immediately possible, block outbound traffic from the Chatwoot instance to untrusted networks or enforce a strict outbound whitelist.', 'Implement request validation in the callbacks_controller.rb to allow only approved Shopify domains.', 'Monitor logs for unexpected outbound HTTP requests and alert on anomalies.']

Risk context

The CVSS v3 score of 6.3 indicates medium severity, and the lack of EPSS data suggests no known widespread exploitation yet. Nonetheless, SSRF can be leveraged for internal reconnaissance or data exfiltration, so timely patching or network restrictions are recommended.

Affected products

• Chatwoot
• Shopify OAuth
• Ruby on Rails
• Open‑source web app