GHSA-j7xp-4mg9-x28r
Low · 3.7CVSS
3.7
EPSS
—
Published
Jan 20, 2026
CISA due date
—
The record
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/chat | 0 | No fix |
Related vulnerabilities
- CVE-2026-23522 LobeChat is an open source chat application platform. Same vulnerability
- GHSA-wrrr-8jcv-wjf5 LobeHub Vulnerable to Improper Authorization in Presigned Upload Also affects @lobehub/chat
- CVE-2026-23835 LobeHub is an open source human-and-AI-agent network. Also affects @lobehub/chat
- GHSA-4gpc-rhpj-9443 Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code… Also affects @lobehub/chat
- CVE-2026-23733 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2024-32965 @lobehub/chat Server Side Request Forgery vulnerability Also affects @lobehub/chat
- CVE-2024-47066 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) Also affects @lobehub/chat
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284