CVE-2026-80337 - Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef

MEDIUM

Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Published Oct 2, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.21%

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Vendor HAVELSAN Inc. Product Sef - AI Chatbot Platform Default
unknown
Affected
- ≥ 0, < 2.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
HAVELSAN Inc.	Sef - AI Chatbot Platform	unknown	Affected ≥ 0, < 2.1

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91324		Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241		government-resource

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner TR-CERT

Published Oct 2, 2026

Updated Oct 2, 2026

Reserved Aug 26, 2026

CISA Vulnrichment

Updated Oct 2, 2026

NVD

Status Deferred

Modified Oct 2, 2026

Red Hat

No data

ENISA EUVD

Assigner TR-CERT

Published Oct 2, 2026

Updated Oct 2, 2026

GitHub

No data