LobeChat CVE-2026-59100

Exploitation requires a valid authenticated session in the LobeChat instance - at minimum a standard user account (CVSS PR:L). The attacker must also enumerate or otherwise obtain valid chat-group identifiers belonging to other users; the CVSS AC:H metric reflects that this is a non-trivial prerequisite, likely because group IDs may be opaque (e.g., UUIDs) rather than sequential integers. The vulnerable operations are specifically getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup - all three lack user-scoped authorization predicates in affected versions. Exploitation is only meaningful in multi-user LobeChat deployments where distinct users share the same instance and have an expectation of data isolation; single-user or private deployments are unaffected in practice. No special non-default configuration is required beyond the standard multi-user deployment mode. Exploitation is limited to read and write operations on chat-group agent metadata and cannot directly achieve code execution or full data exfiltration.

The CVSS 4.0 score of 2.3 with vector AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N places this firmly in the low-severity tier, and the signal convergence across available data supports that classification. The AC:H metric reflects the non-trivial requirement of enumerating or guessing valid group identifiers belonging to other users - if group IDs are UUIDs or otherwise opaque, this substantially limits opportunistic exploitation. Authentication is required (PR:L), meaning unauthenticated external actors cannot exploit this directly. Impact is bounded to low confidentiality, integrity, and availability on the vulnerable system only, with no scope change to downstream or adjacent systems. The publicly available POC (GitHub issue #16537) does lower the technical barrier but does not elevate the intrinsic risk given the AC:H constraint. The CVE's absence from the CISA KEV catalog and no EPSS data in the provided intelligence further suggest this is not under active widespread exploitation. This is a genuine authorization design flaw that warrants patching in multi-user deployments, but it is not a high-priority emergency for most organizations given the combination of required authentication, access complexity, and constrained impact.

An authenticated LobeChat user with a standard account leverages the publicly available proof-of-concept from GitHub issue #16537 to enumerate or brute-force group identifiers belonging to other users on the same instance, then invokes getGroupAgents to harvest the victim's agent configuration. The attacker subsequently calls updateAgentInGroup or removeAgentsFromGroup with the victim's group ID to silently tamper with or disrupt the victim's chat-group agent setup. Because no user interaction or elevated privilege is required beyond a valid session, a malicious insider or compromised low-privilege account can conduct this attack entirely through normal API calls.