[GHSA-j7xp-4mg9-x28r] Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

[pranavjindal29]

Updates

• Affected products

Comments
The affected package/version metadata appears incomplete following the LobeChat package transition.

@lobehub/chat version 1.143.3 still contains the vulnerable removeFilesFromKnowledgeBase implementation with the userId authorization check commented out, so the current <= 1.143.2 range should be extended through 1.143.3.

The project subsequently publishes as @lobehub/lobehub. The public CVE record states that versions prior to 2.0.0-next.193 are affected and recommends upgrading to 2.0.0-next.193. The fixing commit adds the missing userId authorization check to removeFilesFromKnowledgeBase.

Supporting references:
https://github.com/lobehub/lobehub/blob/v1.143.3/packages/database/src/models/knowledgeBase.ts
lobehub/lobehub@2c1762b
https://github.com/lobehub/lobehub/releases/tag/v2.0.0-next.193
https://nvd.nist.gov/vuln/detail/CVE-2026-23522

[github]

Hi there @arvinxx! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory