LibreDesk agent permissions need a role-union review
LibreDesk agent permissions need a role-union review
LibreDesk is a self-hosted customer support platform that combines email, chat, a knowledge base, and agent workflows. Its API keys belong to agents. The official documentation says a request made with an API key has the same roles and permissions as the agent that owns the key, and an agent's effective access is the union of permissions across assigned roles.
That model is convenient for support teams. It also means an API key is a durable representation of a person's permissions. A key created for an integration can retain access after the agent changes teams, and multiple roles can produce a permission set that no single role describes.
Measure the candidate population
On 2026-11-08, count-only ZoomEye probes used sub_type=all, page 1, and page size 1. app="LibreDesk" returned 74, title="LibreDesk" returned 2, and port="9000" && title="LibreDesk" returned 0.
The application signal is larger than the title signal, which is plausible for a product whose login page may not carry a stable brand title. It is also a warning against using one field. The app count is not proof that 74 installations are vulnerable or that they expose customer data. It identifies a set of candidates for ownership checks.
Where the permission boundary sits
The documentation says opening a conversation requires conversations:read plus a list permission that matches how the conversation is assigned. The assignment list is part of the permission check. An agent with broad conversation access but a narrow mailbox or team list may see one set of tickets; a different assignment can produce another.
Review roles by the actions they combine, not by their labels. Check access to contacts, exports, user management, channels, webhooks, and AI or integration settings. Exports are especially sensitive because they can copy a contact's stored data. The ability to change roles is administrative authority and should be limited to a fully trusted group.
Review checklist
List every agent, role, API key, and SSO group mapping. For each key, record its owner, created time, last use, and effective permissions. Remove keys that belong to departed agents or integrations with no owner. Test a list endpoint and a direct object endpoint separately; a list permission should not be assumed to protect an identifier that can be guessed.
Confirm that the public live-chat widget exposes only the routes needed to start a conversation. Protect the agent application and administrative API behind the intended proxy and identity policy. Review webhook signing and outbound destinations because a support integration may carry customer data and channel credentials.
Defensive baseline
Use least-privilege roles, keep API keys short-lived where the platform permits it, and review the effective union of permissions. Inventory LibreDesk listeners with multiple ZoomEye fields and reconcile them against owned domains. The product count is an inventory signal; the actual control is the relationship between agent identity, role permissions, and ticket scope.
References
原文：https://www.a8q9.cn/en/article/libredesk-agent-permissions-need-a-role-union-review-c3e4d0.html