Which versions of LobeChat are affected by CVE-2026-59098?

LobeChat versions through 2.2.9 contain a cross-user data disclosure vulnerability enabling any authenticated user to access documents, file names, and metadata belonging to other users in…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59098?

Yes, a public proof-of-concept exploit is available for CVE-2026-59098. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-59098?

Within 24 hours: Identify all LobeChat deployments running version 2.2.9 or earlier, document user population and data classification for affected instances, and review semantic search query logs for suspicious cross-user access patterns. Within 7 days: Apply vendor-released patch to upgrade all instances to a patched version beyond 2.2.9, validate patch deployment across all systems, and verify that semantic search access controls now enforce user boundaries. Within 30 days: Conduct forensic review of access logs during the vulnerability window to identify any unauthorized cross-user document access, notify affected users if unauthorized exposure occurred, and implement enhanced monitoring and alerting on RAG semantic search queries.

LobeChat CVE-2026-59098

Q: What is the CVSS score of CVE-2026-59098?

CVE-2026-59098 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41429 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-02 VulnCheck

GHSA-w676-mrp6-5fqq

Authentication Bypass Lobehub

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable RAG endpoint, only a low-privilege account needed (PR:L), no user interaction; impact is confidentiality-only cross-user disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:33 vuln.today

Severity Changed

Jul 02, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Jul 02, 2026 - 20:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method. Attackers can supply arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths to retrieve text content, file names, and metadata belonging to other users.

AnalysisAI

Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' documents by abusing the retrieval-augmented-generation (RAG) semantic search, whose chunk model omits a user-identifier predicate. By supplying arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths, an attacker recovers text content, file names, and metadata belonging to other tenants. Publicly available exploit code exists and a vendor patch has been released; the flaw is not listed in CISA KEV and no active exploitation is reported.

Technical ContextAI

LobeChat (lobehub) is an open-source AI chat framework that supports knowledge bases and RAG, where uploaded files are split into chunks, embedded, and retrieved by vector/semantic similarity to ground model responses. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the chunk model's semanticSearch method performs similarity lookups without scoping the query to the requesting user's identifier, so ownership is never enforced at the data layer. Because the file/knowledge-base identifiers are attacker-controllable and no user predicate filters the result set, the query returns chunks across the entire multi-tenant store. Affected code is identified by CPE cpe:2.3:a:lobehub:lobehub covering all versions up to and including 2.2.9.

RemediationAI

Patch available per vendor advisory: upgrade to the fixed LobeChat release that includes commit 4a7931a4e66832947dba11afdffae2918a56b6a0 (merged via PR https://github.com/lobehub/lobehub/pull/16594); a specific tagged patched version number is not stated in the provided data, so confirm the exact release with the vendor before deploying. If immediate patching is not possible, compensating controls include restricting instance access to trusted users only (disable open/self-service registration so PR:L cannot be trivially satisfied), placing the instance behind an authenticating reverse proxy or VPN, and temporarily disabling or not populating shared knowledge-base/RAG features so no cross-user documents are exposed - the trade-off being loss of RAG functionality for all users. Monitor chunk-retrieval and knowledge-base endpoints for requests referencing file or knowledge-base identifiers the account does not own. See the VulnCheck advisory and GitHub issue 16535 for details.