GHSA-wrrr-8jcv-wjf5
NoneCVSS
—
EPSS
—
Published
Feb 1, 2026
CISA due date
—
The record
LobeHub Vulnerable to Improper Authorization in Presigned Upload
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/chat | 0 | 1.143.3 |
Related vulnerabilities
- CVE-2026-23835 LobeHub is an open source human-and-AI-agent network. Same vulnerability
- GHSA-4gpc-rhpj-9443 Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code… Also affects @lobehub/chat
- GHSA-j7xp-4mg9-x28r Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion Also affects @lobehub/chat
- CVE-2026-23522 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2026-23733 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2024-32965 @lobehub/chat Server Side Request Forgery vulnerability Also affects @lobehub/chat
- CVE-2024-47066 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) Also affects @lobehub/chat
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73