Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Chatwoot

Bug bounty on Sorona chatwoot.com

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
13
Public CVEs
17
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Hall of fame
Yes The acknowledgement on offer is a hall-of-fame listing, direct contact with the security team and early access to patches.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 6 excluded.

Web 1

  • https://www.chatwoot.com

Products and areas 12

  • Automation rules, macros and canned responses, where stored configuration drives later action on live conversations
  • Campaigns, bulk messaging and the contact import and export tooling
  • Contact records and custom attributes, the personal data store at the centre of the product
  • File attachments on conversations, both upload and retrieval
  • The account boundary, since one Chatwoot installation serves multiple accounts and an account is a whole company's conversation history
  • The agent, team and inbox permission model, including which agents can see which conversations and which contacts
  • The embeddable widget itself, which runs on the customer's own website and talks back to the Chatwoot server from an untrusted origin
  • The inbox and channel integrations in full: email, the website widget, WhatsApp, Facebook, Instagram, Telegram, SMS and the generic API channel
  • The policy declares the classes it accepts: remote code execution, SQL injection, authentication bypass, privilege escalation, cross-site scripting and cross-site request forgery. It also publishes a non-qualifying list, and inside the accepted classes it draws no component boundary
  • The public REST API and the access tokens agents and applications authenticate with
  • The super-admin console, which administers every account on the instance
  • Webhooks and outbound integrations, including any destination URL a user supplies
Out of scope (6)
  • Anything on the policy's published non-qualifying list, which the project maintains independently of this page
  • Public disclosure before the maintainers have shipped a fix
  • Self-hosting and deployment configuration choices, including an instance run without the documented environment variables
  • Testing against live instances that hold other people's customer conversations
  • Upstream Rails and dependency issues, unless Chatwoot's own use of the dependency is what makes the defect reachable
  • WhatsApp, Meta, Twilio and the other messaging providers' own systems, which are third-party estates rather than Chatwoot code

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.

While testing

  • Submit through sorona.xyz.
  • File through the GitHub Security Advisory form on chatwoot/chatwoot
  • Read the non-qualifying list before filing
  • Say whether you reproduced on a self-hosted instance or on Chatwoot Cloud, and give the version
  • Name the channel involved.
  • Test on your own account.
  • Time disclosure to the release that carries the fix

Not accepted

  • Anything on the policy's published non-qualifying list
  • WhatsApp, Meta, Twilio and the other messaging providers' own systems
  • Self-hosting and deployment configuration choices
  • Upstream Rails and dependency issues
  • Testing against live instances that hold other people's customer conversations
  • Public disclosure before the maintainers have shipped a fix

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2025-12245 Medium 5.5 27 Oct 2025
CVE-2025-12246 Low 2.1 27 Oct 2025
CVE-2024-0640 Medium 4.8 20 Mar 2025
CVE-2025-21628 Critical 9.1 9 Jan 2025
CVE-2021-3742 High 8.8 15 Nov 2024
CVE-2021-3740 Medium 6.8 15 Nov 2024
CVE-2021-3741 Medium 5.4 15 Nov 2024
CVE-2023-2109 Medium 6.1 17 Apr 2023
CVE-2022-3741 Critical 9.8 28 Oct 2022
CVE-2022-2901 High 7.1 6 Sep 2022
CVE-2022-0542 Medium 6.1 19 Aug 2022
CVE-2022-1021 Medium 5.4 19 Aug 2022
CVE-2022-1022 Medium 5.4 21 Apr 2022
CVE-2021-3813 Medium 6.5 9 Feb 2022
CVE-2022-0526 Medium 6.1 9 Feb 2022
CVE-2022-0527 Medium 6.1 9 Feb 2022
CVE-2021-3649 High 7.5 16 Jul 2021

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 3 Last 12 months Access control 35 % XSS/CSRF 25 % Auth bypass 22 % Injection 18 % Latest advisories Loading the feed Overview Chatwoot is the open-source customer engagement platform teams run instead of Intercom or Zendesk, self-hosted in a container next to the rest of their stack or taken as a cloud tenancy. It aggregates a company's entire customer conversation history across email, live chat, WhatsApp and social inboxes, so one agent-account takeover reads years of private support threads and the personal data inside them. The policy is more explicit than most in this category: it names the vulnerability classes it wants and states plainly that no formal bug bounty programme exists, offering hall-of-fame credit and early patch access instead. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy declares the classes it accepts: remote code execution, SQL injection, authentication bypass, privilege escalation, cross-site scripting and cross-site request forgery. It also publishes a non-qualifying list, and inside the accepted classes it draws no component boundary The account boundary, since one Chatwoot installation serves multiple accounts and an account is a whole company's conversation history The inbox and channel integrations in full: email, the website widget, WhatsApp, Facebook, Instagram, Telegram, SMS and the generic API channel The embeddable widget itself, which runs on the customer's own website and talks back to the Chatwoot server from an untrusted origin The agent, team and inbox permission model, including which agents can see which conversations and which contacts Contact records and custom attributes, the personal data store at the centre of the product The public REST API and the access tokens agents and applications authenticate with Automation rules, macros and canned responses, where stored configuration drives later action on live conversations Webhooks and outbound integrations, including any destination URL a user supplies File attachments on conversations, both upload and retrieval The super-admin console, which administers every account on the instance Campaigns, bulk messaging and the contact import and export tooling Out of scope Anything on the policy's published non-qualifying list, which the project maintains independently of this page WhatsApp, Meta, Twilio and the other messaging providers' own systems, which are third-party estates rather than Chatwoot code Self-hosting and deployment configuration choices, including an instance run without the documented environment variables Upstream Rails and dependency issues, unless Chatwoot's own use of the dependency is what makes the defect reachable Testing against live instances that hold other people's customer conversations Public disclosure before the maintainers have shipped a fix Most-valued findings Anything crossing the account boundary on a shared instance, since each account is a separate company's full support history Agent-to-agent or team-to-team conversation access where the permission model was supposed to keep a conversation private, including inbox assignment rules that can be sidestepped Widget-side defects that let a website visitor read conversations other than their own or impersonate an identified contact, because the widget runs on an origin the attacker often controls Authentication bypass and account takeover, agent accounts above all, since one agent session reads whatever that agent's inboxes hold Privilege escalation from agent to administrator to super-admin, where super-admin reaches every account on the installation Stored cross-site scripting delivered through an inbound customer message, which is the one field in this product an unauthenticated stranger fully controls and an agent is guaranteed to view Server-side request forgery through webhooks, avatar fetching or any other outbound request the server makes on a user's behalf Unauthenticated retrieval of attachments or conversation transcripts through an unchecked identifier SQL injection in contact search, filters or reporting queries, where user input becomes part of a query Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. File through the GitHub Security Advisory form on chatwoot/chatwoot, the primary channel the policy names; [email protected] is for process questions The policy publishes both a list of classes it accepts and a list of things that do not qualify. Read the non-qualifying list before filing Say whether you reproduced on a self-hosted instance or on Chatwoot Cloud, and give the version, since self-hosted operators lag the hosted service Name the channel involved. An inbox fed by email behaves differently from one fed by WhatsApp or by the website widget, and a defect in one is not automatically a defect in the others Test on your own account. Chatwoot instances hold real customer conversations and a live probe against somebody else's inbox reads support threads that are not yours The acknowledgement on offer is a hall-of-fame listing, direct contact with the security team and early access to patches. There is no payment to negotiate Disclosure Coordinated privately through the GitHub advisory form and published as a security advisory alongside a patched release. The project runs a documented triage process with a written policy on what it accepts, and it commits to recognising researchers publicly once a fix is out. No fixed embargo length is published. Time disclosure to the release that carries the fix, and remember that self-hosted operators upgrade slowly, so the practical exposure window outlasts the advisory. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability