GHSA-xmwj-c75x-6346
Critical · 9.0CVSS
9.0
EPSS
—
Published
Jun 16, 2026
CISA due date
—
The record
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/lobehub | 0 | 2.1.57 |
Related vulnerabilities
- CVE-2026-54157 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Same vulnerability
- CVE-2026-42045 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-xq4x-622m-q8fq LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution Also affects @lobehub/lobehub
- CVE-2026-39411 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-5mwj-v5jw-5c97 LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable… Also affects @lobehub/lobehub
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918