Live Helper Chat REST API Vulnerability Allows Unauthorized Chat Tampering

A critical vulnerability, tracked as CVE-2026-44633, has been identified in Live Helper Chat, an open-source application for live website support. According to the National Vulnerability Database, versions up to 4.84 are affected. The flaw resides in the REST API’s chat update endpoint, which permits a REST user with lhchat/use permissions to modify chats in departments they lack read access to. This bypass allows an attacker to manipulate chat hashes and statuses, subsequently gaining unauthorized access or tampering with chats via visitor/widget paths.

The National Vulnerability Database further explains that this write primitive can also set the operation_admin flag. This flag is later emitted as operator-side JavaScript, indicating a potential for client-side code execution or further privilege escalation within the application. With a CVSS score of 8.1 (HIGH), this vulnerability presents a significant risk for organizations utilizing Live Helper Chat, as it could lead to sensitive information disclosure, chat manipulation, and potentially broader system compromise.

Attackers can exploit this by leveraging existing, albeit limited, REST API permissions to pivot into unauthorized administrative control or data access. The attacker’s calculus here is clear: exploit weak authorization to gain control over communication channels, which are often rich in sensitive customer data or operational intelligence. Defenders need to understand that even seemingly low-privilege API access can be weaponized if authorization checks are not rigorously enforced across all endpoints.