Executive brief
A security flaw in the HiJiffy Chatbot, a communication platform used by hotels and guests, allows unauthorized access to private conversations. By manipulating a specific web parameter, an attacker could view and download messages belonging to other users. This could lead to the exposure of sensitive guest information and private booking details.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the HiJiffy Chatbot API. The flaw is located in the '/api/v1/webchat/message' endpoint, where the application fails to properly validate the authorization of the 'visitor' parameter. A remote, unauthenticated attacker can exploit this by supplying different visitor identifiers to retrieve private message history that does not belong to them. The vulnerability was coordinated by INCIBE and the vendor recommends updating to the latest version to mitigate the risk.
Affected products
- HiJiffy Chatbot
Timeline
- 2026-03-17: advisory: Initial advisory published by INCIBE-CERT
- 2026-03-26: disclosed: CVE published to NVD