Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Chatwoot bug bounty programs

chatwoot.com Updated

Chatwoot runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Chatwoot runs.

  • Chatwoot

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://www.chatwoot.com

    Web

  • Automation rules, macros and canned responses, where stored configuration drives later action on live conversations

    Products and areas

  • Campaigns, bulk messaging and the contact import and export tooling

    Products and areas

  • Contact records and custom attributes, the personal data store at the centre of the product

    Products and areas

  • File attachments on conversations, both upload and retrieval

    Products and areas

  • The account boundary, since one Chatwoot installation serves multiple accounts and an account is a whole company's conversation history

    Products and areas

  • The agent, team and inbox permission model, including which agents can see which conversations and which contacts

    Products and areas

  • The embeddable widget itself, which runs on the customer's own website and talks back to the Chatwoot server from an untrusted origin

    Products and areas

  • The inbox and channel integrations in full: email, the website widget, WhatsApp, Facebook, Instagram, Telegram, SMS and the generic API channel

    Products and areas

  • The policy declares the classes it accepts: remote code execution, SQL injection, authentication bypass, privilege escalation, cross-site scripting and cross-site request forgery. It also publishes a non-qualifying list, and inside the accepted classes it draws no component boundary

    Products and areas

  • The public REST API and the access tokens agents and applications authenticate with

    Products and areas

  • The super-admin console, which administers every account on the instance

    Products and areas

  • Webhooks and outbound integrations, including any destination URL a user supplies

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything on the policy's published non-qualifying list, which the project maintains independently of this page

  • Public disclosure before the maintainers have shipped a fix

  • Self-hosting and deployment configuration choices, including an instance run without the documented environment variables

  • Testing against live instances that hold other people's customer conversations

  • Upstream Rails and dependency issues, unless Chatwoot's own use of the dependency is what makes the defect reachable

  • WhatsApp, Meta, Twilio and the other messaging providers' own systems, which are third-party estates rather than Chatwoot code

Recent changes

Reward and scope changes across every Chatwoot program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Chatwoot products, from the NVD.

Search NVD
  • CVE-2025-12245 Medium

    A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any w

  • CVE-2025-12246 Low

    A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

  • CVE-2024-0640 Medium

    A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.

  • CVE-2025-21628 Critical

    Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.

  • CVE-2021-3742 High

    A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.

  • CVE-2021-3740 Medium

    A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.

  • CVE-2021-3741 Medium

    A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.

  • CVE-2023-2109 Medium

    Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.

About this page

This page gathers every public program listed under chatwoot.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.