CVE-2026-58580
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
LobeChat through version 2.2.9 with server-database deployments is vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. An authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance, and the tampered content is served back to the victim.
Risk Assessment
The risk involves unauthorized manipulation of another user's communication data, potentially leading to integrity and confidentiality breaches, as well as impersonation in the context of plugins and voice/translation services.
Recommendation
Immediately update LobeChat to a version newer than 2.2.9 that includes a fix for the authorization flaw. Until the update is applied, restrict access to the tRPC API and monitor logs for unauthorized message modification attempts.
Other vulnerabilities in LobeChat
See all- CVE-2026-59100Medium
LobeChat through version 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.
- CVE-2026-59098Medium
LobeChat up to version 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality. Authenticated attackers can access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method.
- CVE-2026-59095High
LobeChat before version 2.2.10-canary.18 contains a server-side request forgery (SSRF) vulnerability. An authenticated attacker can direct internal HTTP requests to arbitrary URLs by exploiting the skill import (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the ssrf-safe-fetch wrapper.
- CVE-2026-58578Medium
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability. An authenticated attacker can block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. The attacker crafts a malicious basePath value containing unescaped regex metacharacters, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.
Original NVD description (English source)
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. Reachable via the corresponding tRPC message procedures, an authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech and translation records on the same instance, and the tampered content is served back to the victim. Exploitation requires knowledge of the victim's non-enumerable message identifier.