CVE-2026-44633 - Vulnerability Analysis

Overview

Live Helper Chat 4.84v contains a broken access control vulnerability caused by insufficient permission checks in the REST API chat update endpoint, letting REST users with lhchat/use update chats in unauthorized departments and execute operator-side JavaScript, exploit requires REST user privileges.

Severity & Score

Impact

Attackers can modify chat data, access unauthorized chats, and execute JavaScript on operator side, leading to data tampering and client script execution.

Mitigation

Update to the latest version with proper permission checks on chat update endpoint.

References

• https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-hjqq-qmvj-9whm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner