{"id":"CVE-2026-120425","kind":"vulnerability","aliases":["CVE-2026-120425"],"related":[],"title":"Chatify: authorization bypass lets users read other users' private messages","description":"Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.","summary":"Chatify before 1.6.4 has an authorization flaw in its Pusher channel authorization endpoint. An authenticated user can request a signature for another user's private channel and receive that user's incoming private messages and attachments in real time.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chatify","laravel","package","php","pusher"],"not_affected_if":["chat-not-used","chatify-1.6.4-or-later"],"how_to_check":"- Check the installed Chatify version in the project's composer.lock or vendor package metadata; versions before `1.6.4` are affected.\n- Review whether the app exposes POST /chat/auth to any logged-in user.","fix":"- Chatify: upgrade to `1.6.4` or later.","status":"open","published_at":"2026-11-02T15:17:23+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:26:06+00:00","updated_at":"2026-11-02T15:26:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:06Z","model":"claude-haiku-5-5","output":{"fix":"- Chatify: upgrade to `1.6.4` or later.","reach":"internet","title":"Chatify: authorization bypass lets users read other users' private messages","impact":"high","summary":"Chatify before 1.6.4 has an authorization flaw in its Pusher channel authorization endpoint. An authenticated user can request a signature for another user's private channel and receive that user's incoming private messages and attachments in real time.","audience":"developers","category":"package","nicknames":[],"who_cares":["chatify","laravel","php","pusher"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in user reads other users' private messages and attachments","analyst_note":"","how_to_check":"- Check the installed Chatify version in the project's composer.lock or vendor package metadata; versions before `1.6.4` are affected.\n- Review whether the app exposes POST /chat/auth to any logged-in user.","plain_action":"","needs_analyst":false,"not_affected_if":["chatify-1.6.4-or-later","chat-not-used"],"who_is_affected":"Applications that run Chatify before 1.6.4 with the Pusher channel authorization endpoint reachable by logged-in users. Anyone who has an account on such an app can read other users' private chat traffic, so the exposure is through the application's own users rather than unauthenticated visitors. Apps not using Chatify can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4202,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120425':13A,16A '-2026':12A,15A '/chat/auth':102C '1.6.4':24B,63C 'allow':76C 'anoth':43B 'arbitrari':88C 'attach':57B,112C 'attack':91C 'authent':36B,77C 'author':2A,27B,33B,66C,73C 'bypass':3A,67C 'channel':32B,47B,72C,85C,89C 'chatifi':1A,17B,22B,61C,99C 'contain':64C 'cve':11A,14A 'endpoint':34B,74C 'flaw':28B 'incom':53B,108C 'laravel':18B 'let':4A 'messag':10A,55B,110C 'name':90C 'packag':19B 'php':20B 'post':101C 'privat':9A,46B,54B,84C,98C,109C 'private-chatifi':97C 'pusher':21B,31B,71C 'read':6A 'real':59B,114C 'receiv':49B,104C 'request':39B,93C 'signatur':41B,95C 'subscrib':80C 'suppli':87C 'time':60B,115C 'user':5A,8A,37B,44B,51B,78C,83C 'via':100C 'victim':106C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Chatify before 1.6.4 with the Pusher channel authorization endpoint reachable by logged-in users. Anyone who has an account on such an app can read other users' private chat traffic, so the exposure is through the application's own users rather than unauthenticated visitors. Apps not using Chatify can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chatify","high","laravel","package","php","pusher"],"first_public_at":"2026-11-02T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120425","severity":null,"published_at":"2026-11-02T15:17:23+00:00","modified_at":"2026-11-02T15:17:23+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52438,"url":"https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52439,"url":"https://github.com/munafio/chatify/releases/tag/v1.6.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52440,"url":"https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}