CVE-2026-92527

MediumCVSS 6.3/10Last modified Sep 17, 2026

Description

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-925284.2GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that CVE-2026-925294.3GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that CVE-2026-92537.2The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom CVE-2026-925304.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 th CVE-2026-925317.5Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value CVE-2026-925327.5Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges c CVE-2026-925337.1Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly va CVE-2026-925368.8The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2026-925375.3The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versio CVE-2026-925386.1The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Sit CVE-2026-925396.7A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organiza CVE-2026-92548.7An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V