PT-2026-28641 · Unknown · Hijiffy Chatbot

CVE-2026-4263 · Publicado 2026-03-26 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HiJiffy Chatbot (affected versions not specified)

Description An incorrect authorization issue exists in HiJiffy Chatbot that allows an attacker to download private messages from other users. This is achieved by exploiting the visitor parameter within the '/api/v1/webchat/message' API endpoint. The vulnerable parameter visitor allows unauthorized access to messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-4263

Produtos afetados

Hijiffy Chatbot

Referências · 3

• https://twitter.com/cyberbivash/status/2037126757883515216 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4263 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hijiffy-chatbot · Nota