CVE-2026-44633CWE-863

Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries

High · published May 14, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-14T18:46Z
EPSS history
Timeline
  • 14 MAY 18:46Z
    Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries
    cvelistv5