A flaw in authorization controls within the HiJiffy Chatbot permits an attacker to retrieve private messages belonging to other users. By supplying an arbitrary identifier in the /api/v1/download/<ID>/ endpoint, an unauthenticated or improperly authenticated request can be used to export message contents. This weakness corresponds to the CWE-863 category, where access control mechanisms fail to enforce ownership checks, leading to confidentiality violations.

The affected component is the HiJiffy Chatbot service, for all published versions. The exploit originates from the public API endpoint /api/v1/download/<ID>/, which accepts a numeric or string identifier passed as a path parameter.

The CVSS score of 6.9 indicates a medium severity vulnerability that can be leveraged remotely via standard HTTP requests. EPSS information is not available and the issue is not listed in the CISA KEV catalog, but the remote reachability and lack of authentication controls mean that an attacker with internet access can easily target the endpoint. As the vulnerability affects only message data and does not grant system compromise, the impact is limited to privacy breach.