PT-2026-55292 · Lobehub · Lobehub

George Chen · Publicado 2026-07-02 · Atualizado 2026-07-02 · CVE-2026-58580

NVD

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. Reachable via the corresponding tRPC message procedures, an authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech and translation records on the same instance, and the tampered content is served back to the victim. Exploitation requires knowledge of the victim's non-enumerable message identifier.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-58580

Produtos afetados

Lobehub

Referências · 3

• https://github.com/lobehub/lobehub/issues/16534 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58580 · Nota de Segurança
• https://vulncheck.com/advisories/lobechat-broken-object-level-authorization-in-message-sub-resource-writes · Nota