Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

HiJiffy Chatbot allows unauthorized access to private user messages

CVE-2026-4263 · published 7 months ago
Summary

A security issue in the HiJiffy Chatbot allows an attacker to view private messages from other users. This could lead to sensitive information being exposed. Users and administrators should check the chatbot's settings and ensure proper authorization is in place to prevent unauthorized access.

Original advisory text
Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter  'visitor' in '/api/v1/webchat/message'.
Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 
'visitor' in '/api/v1/webchat/message'.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published26 Mar 2026
Updated3 Nov 2026
First seen26 Mar 2026
Sources
CVE-2026-4263 · NVD
Track software like this
Free during beta