rootpwn

medium · CVSS v3 5.3 · EPSS 0.0021

CVE-2026-80337

CVE-2026-80337 is a missing authorization flaw in HAVELSAN Inc. Sef – AI Chatbot Platform that allows unauthorized users to access restricte

Overview

CVE-2026-80337 is a missing authorization flaw in HAVELSAN Inc. Sef – AI Chatbot Platform that allows unauthorized users to access restricted functionality. The vulnerability exists in all versions prior to 2.1 and could enable attackers to perform privileged actions without proper ACL checks.

Description

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Impact

Confidentiality: attackers could read or modify data processed by the chatbot. Integrity: unauthorized changes to chatbot configuration or data. Availability: potential for denial of service by abusing privileged functions. Defenders: system administrators and security teams managing the platform.

Remediation

Upgrade to a supported version or replace the platform. Apply network segmentation to isolate the chatbot. Enforce strict ACLs and monitor for unauthorized access. If upgrade is not possible, restrict API access and require authentication.

Risk context

The CVE has a medium severity score of 5.3 and a very low EPSS of 0.0021, indicating a low likelihood of exploitation in the wild. However, the missing authorization could still be leveraged by determined adversaries, so defenders should assess exposure promptly.

Affected products

  • HAVELSAN Sef AI Chatbot

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
5.3
CVSS v4
—
EPSS
0.0021

missing-authorization ACL AI-chatbot HAVELSAN medium-severity low-epss

← All CVEs

Related CVEs

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.

View analysis

medium

CVE-2025-12828

Ultra Addons Lite for Elementor plugin is vulnerable to stored XSS via the Type Out widget in all versions up to 1.3.2, allowing authenticated contributors to inject malicious scripts into pages. This flaw can lead to defacement, session hijacking, or data theft when users view affected pages. The issue is present in all WordPress installations using the affected plugin.

View analysis