Cyber Posture

CVE-2026-4990

High

Published: 27 March 2026

Published
27 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 15.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4990 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces approved authorizations for access to the signup endpoint, directly preventing bypass via manipulation of the signupEnabled parameter.

prevent

Validates and sanitizes inputs to the signup endpoint, blocking unauthorized manipulation of the signupEnabled argument to true.

prevent

Requires timely remediation of the specific software flaw in Chatwoot's signup endpoint causing improper authorization.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1136 Create Account Persistence
Adversaries may create an account to maintain access to victim systems.
Why these techniques?

Public-facing web app authorization bypass in signup endpoint directly enables remote exploitation (T1190) and facilitates unauthorized account creation (T1136).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper…

more

authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-4990 is an improper authorization vulnerability affecting Chatwoot versions up to 4.11.1. The issue resides in an unknown function within the /app/login file of the Signup Endpoint component, where manipulation of the signupEnabled argument to true bypasses authorization controls. This flaw, linked to CWEs-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization), carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network-accessible nature and lack of prerequisites.

The vulnerability enables remote exploitation by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially permitting unauthorized actions such as improper account creation or access via the signup process.

VulDB advisories, referenced at https://vuldb.com/?ctiid.353877, https://vuldb.com/?id.353877, and https://vuldb.com/?submit.772515, detail the issue and note that the exploit has been publicly disclosed and may be actively used. The vendor was notified early but provided no response, and no patches or mitigations are mentioned in available sources.

The exploit's public disclosure heightens the risk of real-world abuse against unpatched Chatwoot instances.

Details

CWE(s)

CVEs Like This One

CVE-2025-8261Shared CWE-266, CWE-285
CVE-2026-4617Shared CWE-266, CWE-285
CVE-2026-6105Shared CWE-266, CWE-285
CVE-2025-0484Shared CWE-266, CWE-285
CVE-2026-3734Shared CWE-266, CWE-285
CVE-2025-2360Shared CWE-266, CWE-285
CVE-2026-1597Shared CWE-266, CWE-285
CVE-2026-3724Shared CWE-266, CWE-285
CVE-2026-5642Shared CWE-266, CWE-285
CVE-2025-8756Shared CWE-266, CWE-285

References