PT-2026-28641 · Unknown · Hijiffy Chatbot

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4263

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HiJiffy Chatbot (affected versions not specified)

Description An incorrect authorization issue exists in HiJiffy Chatbot that allows an attacker to download private messages from other users. This is achieved by exploiting the visitor parameter within the '/api/v1/webchat/message' API endpoint. The vulnerable parameter visitor allows unauthorized access to messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-4263

Affected Products

Hijiffy Chatbot

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-4263 · Security Note
• https://twitter.com/cyberbivash/status/2037126757883515216 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hijiffy-chatbot · Note