lobehub — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in lobehub, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-85621	LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu CWE-345	6.5	Medium	2026-09-04
CVE-2026-59100	LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations CWE-639	5.0	Medium	2026-07-02
CVE-2026-59098	LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search CWE-639	6.5	Medium	2026-07-02
CVE-2026-59095	LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl CWE-918	7.7	High	2026-07-02
CVE-2026-58580	LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes CWE-639	5.9	Medium	2026-07-02
CVE-2026-58578	LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import CWE-1333	6.5	Medium	2026-07-02
CVE-2026-54157	LobeHub: Unauthenticated SSRF in `/webapi/proxy` CWE-918	9.0	Critical	2026-06-23
CVE-2026-42045	LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) CWE-79	6.2	Medium	2026-05-12
CVE-2026-39411	LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header CWE-287	5.0	Medium	2026-04-08

All 9 known CVE vulnerabilities affecting lobehub with full Chinese analysis, references, and POCs where available.