LobeChat versions up to 2.2.9 contain a broken access control flaw in the retrieval-augmented-generation semantic search component. The flaw stems from missing user-identifier checks in the semanticSearch method, allowing an authenticated user to craft requests that target another user’s file or knowledge-base identifiers. As a result, attackers can retrieve text content, file names, and metadata belonging to other users, exposing sensitive information. This weakness is classified under CWE‑639, which highlights information disclosure caused by improper input validation and authorization.

The affected product is LobeChat from lobehub, specifically versions 2.2.9 and earlier. Any installation that has not yet applied the patch in the commit referenced in the advisory is vulnerable.

Attacks require an authenticated session to LobeChat. The CVSS score of 7.1 indicates a high severity rating, but the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the catalog. Based on the description, it can be inferred that attackers can craft requests to the unscoped RAG semantic search endpoint, directly supplying arbitrary victim file or knowledge‑base identifiers to retrieve sensitive content. The flaw is classified as CWE‑639, reflecting improper access controls that expose confidential data.