Sef AI Chatbot EUVD-2026-91323

Exploitation requires an authenticated session with high privileges (CVSS PR:H) on the Sef AI Chatbot Platform running a version before 2.1, plus access to a server-side feature that fetches attacker-controllable URLs. The flaw is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but the high-privilege prerequisite is the primary limiting factor, restricting realistic abuse to trusted/elevated users or compromised privileged accounts. Impact is confined to confidentiality (C:H, I:N, A:N) - i.e., reading internal resources reachable from the server - with no scope change (S:U).

This is a moderate, authentication-gated SSRF (CWE-918) in HAVELSAN's Sef AI Chatbot Platform, reported by Turkey's national CERT (TR-CERT). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) indicates a network-reachable but high-privilege-required flaw with high confidentiality impact only - consistent with an authenticated user coercing the server into making requests to internal resources. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The PR:H requirement is the dominant mitigating factor: an attacker must already hold elevated privileges on the platform, which substantially narrows the realistic threat to insiders or already-compromised privileged accounts. Net assessment: this is a real but lower-tier priority - a genuine confidentiality risk in a specific vendor product rather than a widespread, low-friction threat. Note one tension to verify: SSRF typically needs only low privileges to abuse an outbound-request feature, yet the vector asserts PR:H - verify with the vendor whether the vulnerable function is genuinely admin-only.

A high-privileged, authenticated user of the Sef AI Chatbot Platform supplies a crafted URL to a server-side feature (e.g., a webhook, URL-fetch, or integration setting), causing the backend to issue requests to internal-only endpoints such as cloud metadata services or internal admin APIs. The attacker reads the returned data to harvest internal service responses or credentials. No public exploit code is identified at time of analysis, and exploitation requires valid high-privilege credentials.