CVE-2022-2901 Improper Authorization in chatwoot/chatwoot
An attacker can access or modify data without proper authorization in the Chatwoot customer support platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2901?
CVE-2022-2901 is a high-severity missing authorization vulnerability in chatwoot/chatwoot, published on 6 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
Weakness: CWE-285
Which versions are affected by CVE-2022-2901?
It affects 1 product.
Products include Chatwoot Chatwoot.
How do I fix CVE-2022-2901?
No fix has been published for CVE-2022-2901 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-2901 being exploited?
There is no known exploitation of CVE-2022-2901 in the wild and no public exploit code.
Other vulnerabilities in chatwoot/chatwoot
- CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
- CVE-2025-21628 Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
- CVE-2022-0542 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
- CVE-2022-1022 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
- CVE-2021-3742 Server-Side Request Forgery (SSRF) in chatwoot/chatwoot
Sources
Also known as GHSA-2g92-fxg4-7jq9.