CVE-2026-4990

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-266
• CWE-285

• https://vuldb.com/?ctiid.353877
• https://vuldb.com/?id.353877
• https://vuldb.com/?submit.772515

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49882In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible m…8.8
• CVE-2026-49883In checkReadPermission of PermissionsManager.java, there is …5.5
• CVE-2026-49884In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible o…7.8
• CVE-2026-49887In maybeRemoveInvalidInstallerPackageName of InstallReposito…7.8
• CVE-2026-4989Improper input validation in the gateway health check featur…4.3
• CVE-2026-49895In get_eht_operation_channel_width of ieee802_11_common.c, t…3.5
• CVE-2026-4991A vulnerability was detected in QDOCS Smart School Managemen…5.1
• CVE-2026-49918In multiple functions, there is a possible out of bounds wri…7.8
• CVE-2026-49919In tt_face_colr_blend_layer of ttcolr.c, there is a possible…7.8
• CVE-2026-4992A flaw has been found in wandb OpenUI up to 1.0. This affect…4.3
• CVE-2026-49921In multiple locations, there is a possible memory safety iss…9.8
• CVE-2026-49927In multiple locations, there is a possible out of bounds wri…7.8