EUVD-2026-41422
GHSA-vc6m-gvqm-4jf2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable tRPC endpoint requires low-privilege authentication and knowledge of a non-enumerable ID (AC:H/PR:L); integrity fully compromised for victim's records; confidentiality limited to plugin read-back; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. Reachable via the corresponding tRPC message procedures, an authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech and translation records on the same instance, and the tampered content is served back to the victim. Exploitation requires knowledge of the victim's non-enumerable message identifier.
AnalysisAI
Broken object-level authorization in LobeChat server-database deployments through version 2.2.9 enables any authenticated user to overwrite another user's message sub-resources - including plugin tool-call metadata, plugin state and error fields, text-to-speech records, and translation records - by submitting tRPC API requests that reference the victim's message identifier. Five MessageModel write methods (updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, updateTranslate) and one read method (findMessagePlugin) filter database rows by message ID alone, silently omitting the userId scope enforced in all sibling methods, causing the tampered content to be served back to the victim as their own data. No public exploit has been identified at time of analysis, and practical exploitation is gated by the requirement to possess a victim's non-enumerable message identifier.
Technical ContextAI
LobeChat is an open-source, self-hosted AI chat application that exposes its backend logic through a tRPC API layer backed by a relational database in server-database deployment mode. The affected component is the MessageModel data access layer, which manages per-message metadata records for AI conversation features including plugin invocations (tool calls), plugin state, error details, text-to-speech content, and translations. CWE-639 (Authorization Through User-Controlled Key) describes the pattern precisely: the application uses a caller-supplied object identifier (the message ID) to locate and mutate a database record without verifying that the requesting user is the record's owner. The flaw is architectural - sibling MessageModel methods do include a userId predicate in their WHERE clauses, but the five write methods and one read method implicated in this CVE omit it, making the message ID alone sufficient to address and modify any user's records on the same instance. Affected product per CPE is cpe:2.3:a:lobehub:lobehub:*:*:*:*:*:*:*:*, scoped to server-database deployments only.
RemediationAI
No vendor-released patched version is independently confirmed from the available references - the GitHub issue tracker entry and VulnCheck advisory disclose the flaw but do not reference a tagged fixed release. Monitor the LobeChat GitHub repository and the disclosure issue at https://github.com/lobehub/lobehub/issues/16534 for a confirmed patch version and upgrade immediately upon availability. As a compensating control prior to patching, restrict server-database LobeChat instance registration and access to a fully trusted, closed user population (e.g., require corporate SSO or VPN access to the instance), which directly reduces the pool of authenticated users who could obtain a victim's message ID and exploit the missing userId scope. Exposing the instance to untrusted or public user bases should be avoided until the authorization flaw is resolved. Network-perimeter controls that prevent unauthenticated external access to the tRPC endpoints add defense-in-depth but do not address the authenticated cross-user exploitation path.
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Lobe Chat is an open-source artificial intelligence chat framework. Rated high severity (CVSS 8.8), this vulnerability i
Lobe Chat is an open-source, AI chat framework. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab
Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing
Denial of service in LobeChat before 2.2.10-canary.15 lets an authenticated user hang the entire Node.js server by impor
Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' document
Lobe Chat is an open-source LLMs/AI chat framework. Rated medium severity (CVSS 5.7), this vulnerability is remotely exp
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScri
Webhook signature verification bypass in LobeChat 2.2.1 allows unauthenticated remote attackers to inject forged inbound
Broken object level authorization in LobeChat through version 2.2.9 permits authenticated users to read and manipulate c
Lobe Chat is an open-source artificial intelligence chat framework. Rated medium severity (CVSS 4.3), this vulnerability
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today