CVE Feed

    Dashboard / CVE / CVE-2026-59100

    CVE-2026-59100

    LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.

    Published:Jul 2, 2026
    Last Modified:Jul 14, 2026
    EPS:Jul 2, 2026
    EPSS Score:0.0018
    CVSS Score:5

    Affected Products

    Vendor
    Lobehub
    Product
    Lobehub

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-85621 (CVSS 6.9) — LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feish…
    CVE-2026-59098 (CVSS 7.1) — LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation se…
    CVE-2026-59095 (CVSS 8.3) — LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticate…
    CVE-2026-58580 (CVSS 6) — LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in Mess…
    CVE-2026-58578 (CVSS 7.1) — LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability…
    CVE-2026-54157 (CVSS 9) — LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.…
    CVE-2026-42045 (CVSS 6.2) — LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.…
    CVE-2026-39411 (CVSS 5) — LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High