CVE-2026-80337 PUBLISHED

Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Assigner: TR-CERT
Reserved: 26.08.2026 Published: 02.10.2026 Updated: 02.10.2026

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor HAVELSAN Inc.
Product Sef - AI Chatbot Platform
Versions Default: unknown
  • affected from 0 to 2.1 (excl.)

Credits

  • Akıner KISA finder

References

Problem Types

  • CWE-862 Missing Authorization CWE

Impacts

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs