CVE-2025-62505

LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.

LobeChat through version 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.

LobeChat up to version 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality. Authenticated attackers can access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method.

LobeChat before version 2.2.10-canary.18 contains a server-side request forgery (SSRF) vulnerability. An authenticated attacker can direct internal HTTP requests to arbitrary URLs by exploiting the skill import (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the ssrf-safe-fetch wrapper.

LobeChat through version 2.2.9 with server-database deployments is vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. An authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance, and the tampered content is served back to the victim.

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability. An authenticated attacker can block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. The attacker crafts a malicious basePath value containing unescaped regex metacharacters, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.