CVE-2026-5205 | chatwoot up to 4.11.2 Webhook API lib/webhooks/trigger.rb Webhooks::Trigger url server-side request forgery

A vulnerability was found in chatwoot up to 4.11.2. It has been declared as critical. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-5205. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.