The Live Helper Chat REST API chat update endpoint in version 4.84 allows an authenticated user with the lhchat/use permission to modify any field of a chat object. The API does not enforce department boundaries, so the attacker can change critical properties such as the chat hash, status, and the operation_admin flag. By altering the hash and status a user can gain unauthorized read or write access to chats in other departments, and by setting operation_admin the attacker can inject malicious JavaScript that is later rendered in operator‑side pages. The weakness corresponds to missing authorization controls during update, identified as CWE‑863.

LiveHelperChat, the open‑source live‑support platform, is affected when running version 4.84. The flaw is contained to users who have the lhchat/use scope regardless of their department read permissions.

The CVSS score of 8.1 indicates a high‑severity vulnerability. Because the API requires only a single service‑level permission that is often granted to authenticated REST clients, the barrier to exploitation is low for authorized users. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but its high impact and the ease of triggering it mean that attackers could compromise chat integrity and inject code without needing additional privileges.