CVE-2026-4990

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-499035.5The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGECVE-2026-499067.8An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `aCVE-2026-49913.5A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admCVE-2026-499124.0In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in CVE-2026-499187.8In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege CVE-2026-499197.8In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escaCVE-2026-49924.3A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of thCVE-2026-499219.8In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with CVE-2026-499228.4In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This coulCVE-2026-499238.4In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could leCVE-2026-499246.2In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. TCVE-2026-499277.8In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege
CVE-2026-4990: High severity, CVSS 7.3 | Vulnix