PatchTheCVECVE-2026-27954: Live Helper Chat is an open-source application that enables live support websites
CVE-2026-27954 is a medium-severity flaw (CVSS 6.5) affecting live helper chat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-02-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-27954?
live helper chat: upgrade to newer than 4.52. Exact commands for each OS are on this page.
Is CVE-2026-27954 being exploited?
CVE-2026-27954 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-27954 affect?
CVE-2026-27954 affects live helper chat. Severity is medium (CVSS 6.5). Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without call
How urgent is CVE-2026-27954?
Priority 26/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-51403 MEDIUM 6.5 UPGRADE A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helpe
- CVE-2025-51401 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allo
- CVE-2025-51400 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 al
- CVE-2025-51398 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60
- CVE-2025-51397 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows