CVE-2026-59100
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
LobeChat through version 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.
Risk Assessment
The risk involves unauthorized access to sensitive agent data and manipulation of other users' chat group configurations, potentially leading to data integrity and confidentiality breaches within the organization.
Recommendation
It is recommended to immediately upgrade LobeChat to a version later than 2.2.9 that fixes this vulnerability, and to implement object-level authorization checks for all chat group operations.
Other vulnerabilities in LobeChat
See all- CVE-2026-59098Medium
LobeChat up to version 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality. Authenticated attackers can access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method.
- CVE-2026-59095High
LobeChat before version 2.2.10-canary.18 contains a server-side request forgery (SSRF) vulnerability. An authenticated attacker can direct internal HTTP requests to arbitrary URLs by exploiting the skill import (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the ssrf-safe-fetch wrapper.
- CVE-2026-58580Medium
LobeChat through version 2.2.9 with server-database deployments is vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. An authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance, and the tampered content is served back to the victim.
- CVE-2026-58578Medium
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability. An authenticated attacker can block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. The attacker crafts a malicious basePath value containing unescaped regex metacharacters, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.
Original NVD description (English source)
LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.