Executive brief
HiJiffy Chatbot, a communication platform used by hotels to interact with guests, contains a security flaw that allows unauthorized access to private conversations. An attacker can exploit this vulnerability to download private messages belonging to other users by simply guessing or cycling through identification numbers in the web address. This could lead to the exposure of sensitive guest information and personal data, potentially damaging the reputation of hospitality providers using the service.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the HiJiffy Chatbot API. The flaw is located in the '/api/v1/download/<ID>/' endpoint, where the application fails to properly validate if the requesting user has the permission to access the file associated with the provided 'ID' parameter. A remote, unauthenticated attacker can exploit this by performing an Insecure Direct Object Reference (IDOR) attack, systematically changing the ID to download private message logs belonging to other guests. The vendor recommends updating to the latest version to remediate this issue.
Affected products
- HiJiffy Chatbot
Timeline
- 2026-03-17: advisory: Initial advisory published by INCIBE-CERT
- 2026-03-26: disclosed: CVE published to NVD