PT-2026-28640 · Unknown · Hijiffy Chatbot

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4262

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HiJiffy Chatbot (affected versions not specified)

Description An incorrect authorization issue exists in HiJiffy Chatbot. This allows an attacker to download private messages belonging to other users. The issue is due to improper access control when handling requests to the /api/v1/download/<ID> API endpoint. Specifically, the ID parameter is vulnerable and can be manipulated to access unauthorized data.

Recommendations Restrict access to the /api/v1/download/<ID> API endpoint. Ensure proper authorization checks are implemented before allowing access to user messages based on the ID parameter.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-4262

Affected Products

Hijiffy Chatbot

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-4262 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hijiffy-chatbot · Note