A critical authorization vulnerability in Chatwoot versions 4.11.0 and 4.11.1 allows unauthenticated remote attackers to manipulate account registration settings.

This is an improper authorization vulnerability (CWE-285) located within the signup endpoint at /app/login. An unauthenticated attacker can remotely submit the signupEnabled argument set to true to bypass intended access controls.

Successful exploitation of this vulnerability allows unauthorized users to interact with the registration process, which may lead to unauthorized account creation or system misuse. Given the CVSS score of 7.3, this flaw poses a significant risk to the integrity and administrative control of the Chatwoot platform. Failure to remediate could result in unauthorized entities gaining access to internal communication channels or sensitive customer data.

Immediate Action: Upgrade to the latest version of Chatwoot that addresses this improper authorization flaw. If an update is not immediately available, disable the affected signup functionality.

Proactive Monitoring: Review application access logs for unusual activity targeting the /app/login endpoint, specifically looking for repeated attempts to modify registration parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect incoming requests containing the signupEnabled parameter, specifically when the input is set to true.

Public Exploit Available: Yes, a public exploit has been disclosed via VulDB (ID 353877).

The severity of this authorization bypass necessitates immediate attention from security teams. Because the vulnerability is remotely exploitable without authentication and public details are available, the risk of unauthorized access is elevated. Administrators should prioritize identifying instances of Chatwoot 4.11.0 or 4.11.1 and applying the necessary security patches or configuration changes to neutralize this threat.