Chatify EUVD-2026-115234

Requires a valid authenticated session on a Chatify-powered application running a version before 1.6.4 with the default Pusher broadcasting setup (PR:L). The attacker sends POST /chat/auth supplying an arbitrary channel name of the form private-chatify.<victim id> along with a socket id; the vulnerable endpoint signs any requested channel rather than restricting signing to the caller's own private-chatify.{id} inbox and presence-activeStatus. The attacker must know or enumerate the victim's user id, which is a sequential integer and therefore trivially guessable. Limiting factors: exploitation needs an account on the target instance (so open user registration greatly widens exposure), the impact is confined to reading the victim's incoming private messages and attachments (confidentiality only, no message injection or tampering), and only versions prior to 1.6.4 are affected. No special non-default configuration is required.

This is a genuine, actionable data-confidentiality issue rather than a CVSS-inflated non-event, though it is not top-tier severity. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) shows remote, low-complexity exploitation requiring only low privileges - meaning any registered user of the Chatify-powered application can attack any other user, with high confidentiality impact but no integrity or availability impact. The PR:L requirement is the single most important limiter: this is not an unauthenticated internet-wide flaw, so mass, untargeted exploitation is constrained to applications that allow untrusted account registration. However, Chatify apps are multi-user chat systems where arbitrary user accounts are the norm, so in practice the authentication barrier is trivial to satisfy. No EPSS score was provided and the CVE is not on the CISA KEV list, so there is no evidence of active exploitation; a public technical writeup (hackmd) exists as a PoC reference but is not verified as working exploit code. The vuln.today decision label is 'this_week', consistent with a patched, credibly-reported, confidentiality-impacting authorization flaw that is not an active-exploitation emergency. Net: prioritize patching within the week for any production Chatify deployment that handles sensitive private messages, especially those with open registration.

A low-privileged registered user of a Chatify-based application logs in, then sends a crafted POST to /chat/auth requesting a Pusher signature for the channel private-chatify.<victim id> instead of their own inbox channel. Because pre-1.6.4 signs whatever channel name is supplied, the attacker subscribes to the victim's private channel and receives that victim's incoming private messages and attachments in real time. A public PoC reference exists (hackmd writeup); it is not verified as working exploit code.