EUVD-2026-41429
GHSA-w676-mrp6-5fqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privilege account
-
DeliveryAuthenticate to LobeChat instance
-
ExploitCall chunk retrieval / chat knowledge-base endpoint
-
ExecutionSupply victim file or KB identifiers
-
PersistUnscoped semanticSearch returns cross-user chunks
-
ImpactExfiltrate other users' documents and metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires a valid authenticated LobeChat account (PR:L) and a target instance running version 2.2.9 or earlier that hosts other users' RAG data - i.e., a multi-tenant or shared deployment with populated knowledge bases. The attacker must reach the chunk-retrieval or chat knowledge-base API paths over the network and supply victim-owned file or knowledge-base identifiers; no user interaction or elevated privileges are needed. Limiting factors: single-user/self-hosted instances with no other tenants have nothing to disclose, and deployments that disable public registration make obtaining the required low-privilege account harder, meaningfully reducing real-world exposure despite the network attack vector. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and describes a network-reachable, low-complexity attack requiring only low-privilege authentication (any valid account), with high confidentiality impact and no integrity or availability impact - an accurate profile for an IDOR-style data-disclosure bug. Publicly available exploit code raises practical risk, and the issue was reported by VulnCheck with a corresponding upstream fix, so exploitation is straightforward for anyone with an account on an affected instance. Countervailing factors: it is NOT in CISA KEV, no active exploitation is reported, and no EPSS score was provided, so realistic risk is 'reliably exploitable but not yet weaponized at scale.' The main limiter is the PR:L requirement - impact is highest on multi-tenant or publicly-registrable LobeChat deployments and negligible on single-user instances. |
| Exploit ScenarioDerived | An attacker registers or already holds a low-privilege account on a shared LobeChat instance, then issues chunk-retrieval or chat knowledge-base requests substituting another user's file or knowledge-base identifiers. Because the semanticSearch query lacks a user-scope filter, the server returns the victim's document text, file names, and metadata. Publicly available exploit code makes this repeatable, and the low attack complexity means no timing or special tooling is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' documents by abusing the retrieval-augmented-generation (RAG) semantic search, whose chunk model omits a user-identifier predicate. By supplying arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths, an attacker recovers text content, file names, and metadata belonging to other tenants. Publicly available exploit code exists and a vendor patch has been released; the flaw is not listed in CISA KEV and no active exploitation is reported.
RemediationAI
Patch available per vendor advisory: upgrade to the fixed LobeChat release that includes commit 4a7931a4e66832947dba11afdffae2918a56b6a0 (merged via PR https://github.com/lobehub/lobehub/pull/16594); a specific tagged patched version number is not stated in the provided data, so confirm the exact release with the vendor before deploying. If immediate patching is not possible, compensating controls include restricting instance access to trusted users only (disable open/self-service registration so PR:L cannot be trivially satisfied), placing the instance behind an authenticating reverse proxy or VPN, and temporarily disabling or not populating shared knowledge-base/RAG features so no cross-user documents are exposed - the trade-off being loss of RAG functionality for all users. Monitor chunk-retrieval and knowledge-base endpoints for requests referencing file or knowledge-base identifiers the account does not own. See the VulnCheck advisory and GitHub issue 16535 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LobeChat (lobehub) is an open-source AI chat framework that supports knowledge bases and RAG, where uploaded files are split into chunks, embedded, and retrieved by vector/semantic similarity to ground model responses. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the chunk model's semanticSearch method performs similarity lookups without scoping the query to the requesting user's identifier, so ownership is never enforced at the data layer. Because the file/knowledge-base identifiers are attacker-controllable and no user predicate filters the result set, the query returns chunks across the entire multi-tenant store. Affected code is identified by CPE cpe:2.3:a:lobehub:lobehub covering all versions up to and including 2.2.9.
Know when Lobehub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable RAG endpoint, only a low-privilege account needed (PR:L), no user interaction; impact is confidentiality-only cross-user disclosure with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method. Attackers can supply arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths to retrieve text content, file names, and metadata belonging to other users.
Executive ViewAI
LobeChat versions through 2.2.9 contain a cross-user data disclosure vulnerability enabling any authenticated user to access documents, file names, and metadata belonging to other users in multi-tenant deployments. The vulnerability exploits a missing access control in the semantic search function, creating a confidentiality breach across all system users. With publicly available exploit code and broad accessibility to all authenticated users, this demands immediate remediation to prevent unauthorized data exposure and regulatory violations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Lobe Chat is an open-source artificial intelligence chat framework. Rated high severity (CVSS 8.8), this vulnerability i
Lobe Chat is an open-source, AI chat framework. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab
Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing
Denial of service in LobeChat before 2.2.10-canary.15 lets an authenticated user hang the entire Node.js server by impor
Lobe Chat is an open-source LLMs/AI chat framework. Rated medium severity (CVSS 5.7), this vulnerability is remotely exp
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Path traversal in LobeHub Chat (npm @lobehub/chat, versions 1.84.26 through 2.1.48) lets any authenticated user write ar
Lobe Chat is an open-source artificial intelligence chat framework. Rated medium severity (CVSS 4.3), this vulnerability
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScri
Webhook signature verification bypass in LobeChat 2.2.1 allows unauthenticated remote attackers to inject forged inbound
Broken object level authorization in LobeChat through version 2.2.9 permits authenticated users to read and manipulate c
Exploit-DB