Executive brief
Live Helper Chat is an open-source platform used by businesses to provide real-time customer support. A security flaw in the application's programming interface (API) allows support staff with limited permissions to modify and access chat sessions belonging to departments they are not authorized to see. Furthermore, an attacker can use this flaw to inject malicious scripts that execute in the browsers of other support agents or administrators, potentially leading to full account takeover or unauthorized access to sensitive customer conversations.
Technical details
An incorrect authorization check (CWE-863) exists in the REST API chat update endpoint (`PUT /restapi/chat/{chat_id}`). While the application checks for the `lhchat/use` permission, it uses a flawed logic in `hasAccessToWrite()` that fails to properly enforce department boundaries unless a department is explicitly marked as read-only. Because the endpoint performs mass assignment of arbitrary chat object fields, an attacker can modify sensitive fields such as `hash`, `status`, and `operation_admin`. By changing the `hash`, an attacker can gain unauthorized access to chat contents via visitor/widget paths. Additionally, modifying the `operation_admin` field allows for stored Cross-Site Scripting (XSS), as this field is later executed as JavaScript in the context of an operator or administrator's browser session during polling.
Affected products
- Live Helper Chat Live Helper Chat 4.84v
Timeline
- 2026-05-02: advisory: Original GitHub security advisory published
- 2026-05-14: disclosed: CVE published to NVD