Vulnerabilidades de Livehelperchat
CVEs publicadas que afetam produtos de Livehelperchat: 3 registro(s), com severidade, exploração e correções.
CVE-2026-44633
Alta · 8.1
CWE-863 14/05/2026
Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
CVE-2026-27954
Média · 6.5
CWE-862 25/02/2026
LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.
CVE-2026-0483
Média · 6.9
CWE-79 28/01/2026
Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat
Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.