Beveiligingsadvies

CVE-2026-59100

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-02 19:43:16

Laatst bijgewerkt 2026-07-14 22:03:25

Toegewezen door VulnCheck

CVSS-score 5.0

Status PUBLISHED

Beschrijving

LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers. Attackers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations without user-scoped predicates to read agent listings, modify agent roles and ordering, and remove agents from chat groups belonging to other users.

← Alle CVE's bekijken Bekijk op cve.org ↗