LobeChat CVE-2026-58580

Exploitation requires three concurrent conditions: (1) the LobeChat deployment must be running in server-database mode - local single-user deployments are not affected; (2) the attacker must hold a valid authenticated session on the same instance, matching CVSS PR:L - unauthenticated external attackers cannot reach the tRPC procedures; and (3) the attacker must possess prior knowledge of the target victim's specific message identifier, which the vulnerability description explicitly characterizes as non-enumerable, ruling out brute-force or sequential enumeration as practical discovery vectors. Exploitation is further limited by the requirement that attacker and victim share the same LobeChat instance (no cross-instance impact). The attacker does NOT need elevated or administrative privileges - any registered user account on the instance is sufficient. The high attack complexity (CVSS AC:H) correctly encodes the message-ID-knowledge prerequisite as the primary exploitation barrier.

The CVSS 4.0 base score of 6.0 (Medium) is a reasonable reflection of the actual risk envelope. The High attack complexity (AC:H) is the dominant risk-reducing signal: exploitation is contingent on the attacker possessing the victim's message identifier, which LobeChat characterizes as non-enumerable, making opportunistic mass exploitation impractical. The PR:L metric confirms that only authenticated users on the same instance can exploit this flaw, significantly narrowing the realistic attacker population compared to an unauthenticated network attack. The VI:H (high integrity on the vulnerable system) is the most material risk signal - an attacker can silently poison the AI conversation data that the victim sees rendered, including tool-call outputs and translated content, without triggering any obvious alert. Confidentiality impact is limited (VC:L), confined to plugin data readable via findMessagePlugin for a caller who already knows the ID. No CISA KEV listing is present, and EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified from base rates. There is no confirmed POC. For single-tenant or low-trust-boundary deployments the real-world risk is further diminished; for multi-tenant instances serving users who do not fully trust one another, the integrity poisoning capability represents a meaningful threat despite the ID-knowledge prerequisite.

An authenticated user on a shared LobeChat server-database instance acquires a co-user's message ID through interception of application traffic, a companion information-disclosure path, or targeted social engineering. The attacker calls the tRPC updateTranslate or updatePluginState procedure with the victim's message ID and adversarially crafted payload content, bypassing the missing userId authorization check, and the victim subsequently receives the poisoned translation or plugin state in their chat interface as if it were their own conversation data. No public exploit code has been identified; the non-enumerable message ID requirement elevates the practical difficulty above opportunistic mass exploitation.