MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-120425
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-02T16:55:11.069321+00:00
- Cvss score
- 6.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-02T16:56:00+00:00
- Score
- 6.5
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-120425
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-02T16:50:29+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-11-02T15:17:23.407
- Last modified
- 2026-11-02T16:17:32.070
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph