PT-2026-28640 · Unknown · Hijiffy Chatbot

Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-4262

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HiJiffy Chatbot (affected versions not specified)

Description An incorrect authorization issue exists in HiJiffy Chatbot. This allows an attacker to download private messages belonging to other users. The issue is due to improper access control when handling requests to the /api/v1/download/<ID> API endpoint. Specifically, the ID parameter is vulnerable and can be manipulated to access unauthorized data.

Recommendations Restrict access to the /api/v1/download/<ID> API endpoint. Ensure proper authorization checks are implemented before allowing access to user messages based on the ID parameter.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-4262

Produtos afetados

Hijiffy Chatbot

Referências · 2

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hijiffy-chatbot · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4262 · Nota de Segurança