What is CVE-2026-27954?

CVE-2026-27954 is a medium-severity vulnerability in Livehelperchat Live_helper_chat, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-02-26.

How severe is CVE-2026-27954?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Livehelperchat Live_helper_chat

CVE-2026-27954

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without cal…

Vulnerability class: Broken Access Control

EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Livehelperchat Live_helper_chat
Livehelperchat — versions <= 4.52

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-27954?: CVE-2026-27954 is a medium-severity vulnerability in Livehelperchat Live_helper_chat, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-02-26.
How severe is CVE-2026-27954?: Medium severity. CVSS v3 base score is 6.5 out of 10.