CVE-2026-27954

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27954", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:11:36.691Z", "datePublished": "2026-02-26T01:42:38.225Z", "dateUpdated": "2026-02-26T19:30:20.351Z"}, "containers": {"cna": {"title": "LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7"}], "affected": [{"vendor": "LiveHelperChat", "product": "livehelperchat", "versions": [{"version": "<= 4.52", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:42:38.225Z"}, "descriptions": [{"lang": "en", "value": "Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available."}], "source": {"advisory": "GHSA-87wc-2p86-h3w7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T19:30:11.251760Z", "id": "CVE-2026-27954", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:30:20.351Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27954", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T19:30:11.251760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:30:16.446Z"}}], "cna": {"title": "LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints", "source": {"advisory": "GHSA-87wc-2p86-h3w7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "LiveHelperChat", "product": "livehelperchat", "versions": [{"status": "affected", "version": "<= 4.52"}]}], "references": [{"url": "https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7", "name": "https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:42:38.225Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27954", "state": "PUBLISHED", "dateUpdated": "2026-02-26T19:30:20.351Z", "dateReserved": "2026-02-25T03:11:36.691Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T01:42:38.225Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "livehelperchat", "vendor": "LiveHelperChat", "versions": [{"status": "affected", "version": "<= 4.52"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:livehelperchat:live_helper_chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "25D6DDBF-F7C2-4269-B928-4EFAB78A8992", "versionEndIncluding": "4.52", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "Live Helper Chat es una aplicaci\u00f3n de c\u00f3digo abierto que permite sitios web de soporte en vivo. En versiones hasta la 4.52 inclusive, tres puntos finales de acci\u00f3n de chat (holdaction.PHP, blockuser.PHP y transferchat.PHP) cargan objetos de chat por ID sin llamar a 'erLhcoreClassChat::hasAccessToRead()', lo que permite a los operadores actuar sobre chats en departamentos a los que no est\u00e1n asignados. Los operadores con los permisos de rol relevantes (holduse, allowblockusers, allowtransfer) pueden retener, bloquear usuarios de, o transferir chats en departamentos a los que no est\u00e1n asignados. Esto es una escalada de privilegios horizontal dentro de una organizaci\u00f3n. A la fecha de publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "id": "CVE-2026-27954", "lastModified": "2026-06-17T10:27:58.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27954", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T19:30:11.251760Z", "version": "2.0.3"}}]}, "published": "2026-02-26T02:16:23.147", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/LiveHelperChat/livehelperchat/security/advisories/GHSA-87wc-2p86-h3w7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.52]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "livehelperchat", "source": "cna", "vendor": "LiveHelperChat"}, "product": "livehelperchat", "vendor": "livehelperchat"}], "analysis": {"en": {"generated_at": "2026-04-17T14:31:07.850509+00:00", "value": {"mitigation_remediation": ["Await an official vendor patch and upgrade to a patched version as soon as it is released", "If no patch is available immediately, limit the holduse, allowblockusers, and allowtransfer role permissions to only those operators who absolutely require them", "Enable comprehensive logging and audit trails for hold, block, and transfer actions so that unauthorized activity can be detected and investigated promptly"], "summary": {"action": "Assess Impact", "impact": "Permission Escalation (department-level access)"}, "threat_synthesis": {"affected_systems": "LiveHelperChat (open\u2011source live support application) with versions 4.52 and earlier is affected. The vulnerability is present in the holdaction.php, blockuser.php, and transferchat.php endpoints, and operators possessing the holduse, allowblockusers, or allowtransfer permissions can exploit it within the same installation.", "description_and_impact": "LiveHelperChat versions up to 4.52 allow operators with certain role permissions to load chat objects by ID without performing a required read\u2011access check. As a result, operators can hold, block, or transfer chats belonging to departments to which they are not assigned, granting them unauthorized actions within the same organization. This flaw constitutes a horizontal privilege escalation that enables an operator to manipulate chats beyond their intended scope.", "risk_and_exploitability": "The CVSS score is 4.9, indicating moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an authenticated HTTP request to one of the affected endpoints by an operator who already has the relevant permission flags. Attackers could thereby manipulate chats in unapproved departments, affecting the confidentiality, integrity, and availability of support operations. No patched versions are currently available, meaning the flaw remains open for exploitation until a fix is released."}}}}, "created": "2026-02-26T13:09:56.265983+00:00", "updated": "2026-04-17T14:45:21.019586+00:00", "vendors": ["livehelperchat", "livehelperchat$PRODUCT$livehelperchat"]}