CVE-2026-59098
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality th
CVSS
6.5
Medium
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Published: Jul 2, 2026 · Last modified: Jul 14, 2026 · CWE-639
0.2%EPSS · 30 days0.2%
2026-07-032026-07-18
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method. Attackers can supply arbitrary victim file or knowledge-base identifiers through the chunk retrieval and chat knowledge-base paths to retrieve text content, file names, and metadata belonging to other users.
- github.comhttps://github.com/lobehub/lobehub/commit/4a7931a4e66832947dba11afdffae2918a56b6a0
- github.comhttps://github.com/lobehub/lobehub/issues/16535
- github.comhttps://github.com/lobehub/lobehub/pull/16594
- www.vulncheck.comhttps://www.vulncheck.com/advisories/lobechat-cross-user-document-disclosure-via-unscoped-rag-semantic-search
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-552558.4 HIG42.8%
KEV—63Langflow Authorization Bypass Through User-Controlled Key Vulnerability10dCVE-2021-464168.1 HIG89.9%
——27Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.5dCVE-2022-289867.5 HIG80.9%
——24LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.10dCVE-2020-234465.3 MED65.5%
——20Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API10dCVE-2021-33806.5 MED61.5%
——18Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.10dCVE-2022-362029.8 CRI51.5%
——15Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter.10d