Authorization bypass in Chatify exposes other users' private channels
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Chatify before 1.6.4 contains an authorization bypass in the Pusher channel authorization endpoint (CWE-639). An authenticated user can request a signature for another user's private channel by supplying an arbitrary channel name, and then receive that user's incoming private messages and attachments in real time.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Chatify to version 1.6.4, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA Chatify (munafio) Fixed in 1.6.4
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120425
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Alias added: GHSA-ppjp-65hc-5g55
References
Sources
- CVE-2026-120425 · CVE Program
- CVE-2026-120425 · NVD
- FIRST EPSS
- GHSA-ppjp-65hc-5g55 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences