LiveHelperChat versions up to 4.52 allow operators with certain role permissions to load chat objects by ID without performing a required read‑access check. As a result, operators can hold, block, or transfer chats belonging to departments to which they are not assigned, granting them unauthorized actions within the same organization. This flaw constitutes a horizontal privilege escalation that enables an operator to manipulate chats beyond their intended scope.

LiveHelperChat (open‑source live support application) with versions 4.52 and earlier is affected. The vulnerability is present in the holdaction.php, blockuser.php, and transferchat.php endpoints, and operators possessing the holduse, allowblockusers, or allowtransfer permissions can exploit it within the same installation.

The CVSS score is 4.9, indicating moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an authenticated HTTP request to one of the affected endpoints by an operator who already has the relevant permission flags. Attackers could thereby manipulate chats in unapproved departments, affecting the confidentiality, integrity, and availability of support operations. No patched versions are currently available, meaning the flaw remains open for exploitation until a fix is released.