---
id: "CVE-2026-120425"
kind: "vulnerability"
aliases: ["CVE-2026-120425"]
title: "Chatify: authorization bypass lets users read other users' private messages"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chatify", "laravel", "package", "php", "pusher"]
not_affected_if: ["chat-not-used", "chatify-1.6.4-or-later"]
published_at: "2026-11-02T15:17:23+00:00"
first_seen_at: "2026-11-02T15:24:01+00:00"
updated_at: "2026-11-02T15:26:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120425", "first_seen_at": "2026-11-02T15:24:01+00:00"}]
---

# Chatify: authorization bypass lets users read other users' private messages

Chatify before 1.6.4 has an authorization flaw in its Pusher channel authorization endpoint. An authenticated user can request a signature for another user's private channel and receive that user's incoming private messages and attachments in real time.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chatify version in the project's composer.lock or vendor package metadata; versions before `1.6.4` are affected.
- Review whether the app exposes POST /chat/auth to any logged-in user.

## Fix

- Chatify: upgrade to `1.6.4` or later.

## Timeline

- 2026-11-02T15:24:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120425

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint
- [fix] Patch: github.com https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a
- [fix] Release notes: github.com https://github.com/munafio/chatify/releases/tag/v1.6.4

## From the sources

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_