The vulnerability resides in the HiJiffy Chatbot's authorization logic. Because of an incorrect check, requests to the /api/v1/webchat/message endpoint can specify a 'visitor' parameter and retrieve messages that belong to other users. This results in an unauthorized disclosure of private content. The weakness maps to CWE‑863, Authorization Bypass through Privilege Escalation. An attacker can obtain sensitive personal or business information contained in these messages, affecting confidentiality and possibly reputation.

The flaw affects all versions of the HiJiffy Chatbot software, as indicated by the CPE reference that covers every release. Administrators of installations using HiJiffy Chatbot should verify that their version is current, as older releases lack the authorization fix.

The CVSS score of 6.9 places this issue in the moderate-to-high range, indicating significant potential impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. However, the attack path is straightforward: an unauthenticated user can send an HTTP request to the API endpoint with a crafted 'visitor' parameter, so the likelihood of exploitation in the wild remains reasonable. Infrastructure with open API access or without network segmentation could be at higher risk.