CVE-2026-27954 LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints

Medium 4.9 Published 26 Feb 2026 Updated 26 Feb 2026

Operators can hold, block, or transfer chats in unauthorized departments due to missing access checks, enabling horizontal privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-27954?

CVE-2026-27954 is a medium-severity missing authorization vulnerability in livehelperchat, published on 26 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.

Weakness: CWE-862

Which versions are affected by CVE-2026-27954?

It affects 1 product.

Products include Livehelperchat Live Helper Chat.

How do I fix CVE-2026-27954?

No fix has been published for CVE-2026-27954 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-27954 being exploited?

There is no known exploitation of CVE-2026-27954 in the wild and no public exploit code.

Sources

Also known as GHSA-87wc-2p86-h3w7.