Unauthorized File Deletion in LobeChat by LobeHub

CVE-2026-23522

What is CVE-2026-23522?

LobeChat, an open-source chat application developed by LobeHub, contains a security flaw in its knowledgeBase.removeFilesFromKnowledgeBase tRPC endpoint. This allows authenticated users to delete files from other users' knowledge bases without proper authorization checks. The vulnerability arises because the userId filter in the database query is commented out, which means that any authenticated user can potentially delete files if they possess knowledge of the target knowledge base ID and the file ID. Although the IDs are randomly generated and not easily guessable, they may be exposed through shared links or logs. Users must upgrade to version 2.0.0-next.193 to prevent unauthorized file deletions.

References