Description
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
Published: 2024-01-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-0393 Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
Github GHSA Github GHSA GHSA-pf55-fj96-xf37 @lobehub/chat vulnerable to unauthorized access to plugins
History

Tue, 17 Jun 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Lobehub Lobe Chat
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-06-17T21:29:21.984Z

Reserved: 2024-01-25T15:09:40.210Z

Link: CVE-2024-24566

cve-icon Vulnrichment

Updated: 2024-08-01T23:19:52.946Z

cve-icon NVD

Status : Modified

Published: 2024-01-31T17:15:39.173

Modified: 2024-11-21T08:59:26.090

Link: CVE-2024-24566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses