The vulnerability in LobeChat 2.2.9 and earlier is a broken object‑level authorization flaw modelled as CWE‑639. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, and findMessagePlugin reads by id alone, omitting the userId scope that sibling methods apply. This allows an authenticated user who knows another user's message identifier to overwrite the victim's plugin tool‑call metadata, plugin state or error, text‑to‑speech and translation records. The tampered content is served back to the victim, permitting unauthorized modification of user‑specific data but not code execution.

Affected deployments are the server‑database installations of LobeChat released by Lobehub up to version 2.2.9. The flaw resides in the backend MessageModel, so any instance of LobeChat that exposes the tRPC message procedures and runs a vulnerable version is susceptible. No other product versions or client‑side configurations are known to be impacted.

The CVSS base score of 6.0 indicates a medium severity risk. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, meaning exploitation is currently unlikely. Based on the description, it is inferred that an attacker would need to be authenticated and to discover a victim’s non‑enumerable message ID—potentially by observing the victim’s message list—before submitting crafted tRPC requests. The likely attack vector is remote through the exposed tRPC endpoints. Organizations should consider upgrading to a patched release or, if not immediately possible, monitor for write activity that does not include a matching user‑ID correlation.