PT-2026-22103 · Unknown · Livehelperchat

Remdexp · Publicado 2026-02-26 · Atualizado 2026-02-26 · CVE-2026-27954

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Live Helper Chat versions up to and including 4.52

Description Live Helper Chat is an open-source application used for live support websites. The application allows operators to perform actions on chats in departments they are not assigned to due to missing access checks. Specifically, the holdaction.php, blockuser.php, and transferchat.php endpoints load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead(). This allows operators with the holduse, allowblockusers, and allowtransfer role permissions to hold, block users from, or transfer chats in departments they are not authorized to access. This constitutes a horizontal privilege escalation within an organization.

Recommendations Update to a version of Live Helper Chat beyond 4.52.

Exploit

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-27954

GHSA-87WC-2P86-H3W7

Produtos afetados

Livehelperchat

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27954.json · Exploit
• https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27954 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2026960186372448662 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027004214782632444 · Publicação no Twitter
• https://t.me/CVEtracker/45806 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27954 · Aviso do Fabricante