PT-2026-3454 · Lobe Chat · Lobe Chat

Denizparlak · Publicado 2026-01-19 · Atualizado 2026-01-20 · CVE-2026-23522

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.0.0-next.193

Description LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, the knowledgeBase.removeFilesFromKnowledgeBase tRPC endpoint allows authenticated users to delete files from any knowledge base without proper ownership verification. The userId filter in the database query is commented out, enabling attackers to delete other users' knowledge base files if they know the knowledge base ID and file ID. Practical exploitation requires knowing the target's knowledge base ID and file ID, which may leak through shared links, logs, or referrer headers. This missing authorization check is a critical security flaw.

Recommendations Upgrade to version 2.0.0-next.193 to receive a patch.

Exploit

Correção

Missing Authorization

Improper Access Control

IDOR

Enumeração de Fraquezas

CWE-862

CWE-915

CWE-284

CWE-639

Identificadores relacionados

CVE-2026-23522

GHSA-J7XP-4MG9-X28R

Produtos afetados

Lobe Chat

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23522.json · Exploit
• https://github.com/lobehub/lobe-chat · Nota
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-j7xp-4mg9-x28r · Nota
• https://github.com/lobehub/lobe-chat/commit/2c1762b85acb84467ed5e799afe1499cd2f912e6 · Nota
• https://twitter.com/CVEnew/status/2013300671672377536 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23522 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2013319187561591260 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-j7xp-4mg9-x28r · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23522 · Aviso do Fabricante