PT-2026-22103 · Unknown · Livehelperchat

Remdexp · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-27954

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Live Helper Chat versions up to and including 4.52

Description Live Helper Chat is an open-source application used for live support websites. The application allows operators to perform actions on chats in departments they are not assigned to due to missing access checks. Specifically, the holdaction.php, blockuser.php, and transferchat.php endpoints load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead(). This allows operators with the holduse, allowblockusers, and allowtransfer role permissions to hold, block users from, or transfer chats in departments they are not authorized to access. This constitutes a horizontal privilege escalation within an organization.

Recommendations Update to a version of Live Helper Chat beyond 4.52.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27954

GHSA-87WC-2P86-H3W7

Affected Products

Livehelperchat

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27954.json · Exploit
• https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27954 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27954 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2026960186372448662 · Twitter Post
• https://twitter.com/CVEnew/status/2027004214782632444 · Twitter Post
• https://t.me/CVEtracker/45806 · Telegram Post