PT-2026-55300 · Lobe Chat · Lobe Chat

George Chen · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-59100

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.3.0

Description An issue exists where authenticated attackers can access and modify chat-group agent data belonging to other users by providing arbitrary group identifiers. This is caused by a broken object level authorization, which occurs when an application does not properly verify if the user has permission to access a specific object. Attackers can perform the following operations without user-scoped predicates to read agent listings, modify agent roles and ordering, or remove agents from groups:

• getGroupAgents()
• updateAgentInGroup()
• removeAgentsFromGroup()

Recommendations Update LobeChat to version 2.3.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-59100

Affected Products

Lobe Chat

References · 7

• 🔥 https://github.com/lobehub/lobehub/issues/16537 · Exploit
• https://github.com/lobehub/lobehub/commit/9ed5a7e20d8a67c431265f5a252e9559d9920907 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59100 · Security Note
• https://github.com/lobehub/lobehub/pull/16586 · Note
• https://vulncheck.com/advisories/lobechat-broken-object-level-authorization-via-chat-group-agent-operations · Note
• https://twitter.com/CVEnew/status/2072814583933485089 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072815491916107964 · Twitter Post