---
id: 9164
title: "[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService"
cve: CVE-2026-44706
source_domain: yokai.hakaisecurity.io
source_url: "https://yokai.hakaisecurity.io/en-cve-2026-44706-sql-injection-in-chatwoot-filterservice/"
published_at: "2026-06-05T19:18:01Z"
tags: ["vulnerability-research", "sql-injection", "research"]
phying_url: "https://phying.com/item/9164"
lang: en
---

# [EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService

## Summary

Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated agent to read the entire PostgreSQL database, including user credentials and API tokens. The vulnerability resides in the FilterService method, where user input is directly interpolated into SQL queries without parameterization. Exploitation requires […]

## Intelligence Metadata

- **Sources:** yokai.hakaisecurity.io
- **CVE:** CVE-2026-44706
- **Published:** 2026-06-05T19:18:01Z
- **Original:** https://yokai.hakaisecurity.io/en-cve-2026-44706-sql-injection-in-chatwoot-filterservice/
- **Phying News:** https://phying.com/item/9164