Broken Access Control in LobeChat Affects User Data Privacy
CVE-2026-59098

7.1HIGH

Key Information:

Vendor

Lobehub

Status
Lobehub
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-59098?

LobeChat versions up to 2.2.9 are affected by a broken access control vulnerability in its retrieval-augmented-generation semantic search functionality. This flaw allows authenticated attackers to exploit missing user-identifier checks, granting them unauthorized access to other users' data. By manipulating the chunk retrieval paths, attackers can expose sensitive text content, file names, and metadata. It is crucial for users of LobeChat to apply necessary updates and implement security best practices to safeguard user information against potential exploits.

Affected Version(s)

lobehub 0 <= 2.2.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-59098 - Proof of Concept

References

https://github.com/lobehub/lobehub/issues/16535
technical-descriptionexploit
https://github.com/lobehub/lobehub/pull/16594
issue-tracking
https://github.com/lobehub/lobehub/commit/4a7931a4e668329...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.