Description
LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lobehub | lobehub | ≤ 2.2.9 | — |
References
- Researcher Disclosure technical-description exploit issue-tracking
- Fix PR issue-tracking patch
- Fix Commit patch
- https://www.vulncheck.com/advisories/lobechat-broken-object-level-authorization-via-chat-group-agent-operations third-party-advisory