CVE-2026-44633

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.

• CWE-863

• https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-hjqq-qmvj-9whm
• https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-hjqq-qmvj-9whm

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44622Charging station authentication identifiers are publicly acc…6.9
• CVE-2026-44628An unauthenticated attacker can crash the worklist server wi…8.7
• CVE-2026-4463Heap buffer overflow in WebRTC in Google Chrome prior to 146…8.8
• CVE-2026-44630Improper validation of length fields in the Apache IoTDB RPC…7.5
• CVE-2026-44631Buffer Underwrite vulnerability in Apache HTTP Server on cra…9.8
• CVE-2026-44632Yamcs is a mission control framework. Prior to 5.12.7, a ser…9.1
• CVE-2026-44634SimpleBLE is a cross-platform library and bindings for Bluet…8.7
• CVE-2026-44635Kysely is a type-safe TypeScript SQL query builder. From 0.2…7.5
• CVE-2026-44636libsixel is a SIXEL encoder/decoder implementation derived f…7.8
• CVE-2026-44637libsixel is a SIXEL encoder/decoder implementation derived f…7.1
• CVE-2026-44638libsixel is a SIXEL encoder/decoder implementation derived f…2.5
• CVE-2026-4464Integer overflow in ANGLE in Google Chrome prior to 146.0.76…8.8