{"id":"CVE-2026-59100","title":"LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations","summary":"LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke …","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"lobehub","product":"lobehub","affected":["lobehub <= 2.2.9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-06T16:20:42.491534Z"},"exploitAvailable":true,"published":"2026-07-02","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:21.173Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59100","references":[{"url":"https://github.com/lobehub/lobehub/issues/16537","label":"Researcher Disclosure"},{"url":"https://github.com/lobehub/lobehub/pull/16586","label":"Fix PR"},{"url":"https://github.com/lobehub/lobehub/commit/9ed5a7e20d8a67c431265f5a252e9559d9920907","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/lobechat-broken-object-level-authorization-via-chat-group-agent-operations"}],"tags":["cve.org","exploit-available"],"epss":0.00291,"epssPercentile":0.21773,"ingestedAt":"2026-11-08T14:51:22.280Z","slug":"CVE-2026-59100","body":"## Overview\n\nLobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.\n\n## Affected\n\n- `lobehub <= 2.2.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}