CVE-2026-58580
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
A vulnerability in LobeChat through version 2.2.9 server-database deployments allows broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter target rows by message ID only, omitting the userId scope applied by sibling methods, and findMessagePlugin reads back by ID alone. An authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance, with tampered content served back to the victim.
Risk Assessment
The risk involves unauthorized modification of other users' data, potentially leading to data integrity breaches, impersonation, or disruption of communication features (e.g., TTS, translation). Exploitation requires knowledge of the victim's non-enumerable message identifier, which limits but does not eliminate the risk.
Recommendation
Immediately upgrade LobeChat to version 2.2.10 or later, which includes a fix for the missing object-level authorization. If an upgrade is not possible, restrict access to tRPC API procedures for authenticated users and monitor for unusual message modification requests.
Original NVD description (English source)
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. Reachable via the corresponding tRPC message procedures, an authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech and translation records on the same instance, and the tampered content is served back to the victim. Exploitation requires knowledge of the victim's non-enumerable message identifier.