EUVD-2026-41429
GHSA-w676-mrp6-5fqq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable RAG endpoint, only a low-privilege account needed (PR:L), no user interaction; impact is confidentiality-only cross-user disclosure with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method. Attackers can supply arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths to retrieve text content, file names, and metadata belonging to other users.
AnalysisAI
Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' documents by abusing the retrieval-augmented-generation (RAG) semantic search, whose chunk model omits a user-identifier predicate. By supplying arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths, an attacker recovers text content, file names, and metadata belonging to other tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated LobeChat account (PR:L) and a target instance running version 2.2.9 or earlier that hosts other users' RAG data - i.e., a multi-tenant or shared deployment with populated knowledge bases. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and describes a network-reachable, low-complexity attack requiring only low-privilege authentication (any valid account), with high confidentiality impact and no integrity or availability impact - an accurate profile for an IDOR-style data-disclosure bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a low-privilege account on a shared LobeChat instance, then issues chunk-retrieval or chat knowledge-base requests substituting another user's file or knowledge-base identifiers. Because the semanticSearch query lacks a user-scope filter, the server returns the victim's document text, file names, and metadata. … |
| Remediation | Patch available per vendor advisory: upgrade to the fixed LobeChat release that includes commit 4a7931a4e66832947dba11afdffae2918a56b6a0 (merged via PR https://github.com/lobehub/lobehub/pull/16594); a specific tagged patched version number is not stated in the provided data, so confirm the exact release with the vendor before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all LobeChat deployments running version 2.2.9 or earlier, document user population and data classification for affected instances, and review semantic search query logs for suspicious cross-user access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing
Denial of service in LobeChat before 2.2.10-canary.15 lets an authenticated user hang the entire Node.js server by impor
Broken object level authorization in LobeChat through version 2.2.9 permits authenticated users to read and manipulate c
Broken object-level authorization in LobeChat server-database deployments through version 2.2.9 enables any authenticate
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today