CVE Feed

    Dashboard / CVE / CVE-2026-54157

    CVE-2026-54157

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.

    Published:Jun 23, 2026
    Last Modified:Jun 23, 2026
    EPS:Jun 23, 2026
    EPSS Score:
    CVSS Score:9

    Affected Products

    Vendor
    Lobehub
    Product
    Lobehub

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-85621 (CVSS 6.9) — LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feish…
    CVE-2026-59100 (CVSS 2.3) — LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated at…
    CVE-2026-59098 (CVSS 7.1) — LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation se…
    CVE-2026-59095 (CVSS 8.3) — LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticate…
    CVE-2026-58580 (CVSS 6) — LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in Mess…
    CVE-2026-58578 (CVSS 7.1) — LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability…
    CVE-2026-42045 (CVSS 6.2) — LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.…
    CVE-2026-39411 (CVSS 5) — LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High