LobeChat through version 2.2.9 contains a broken access control flaw in its retrieval‑augmented‑generation semantic search functionality. The vulnerability arises from missing user‑identifier predicates in the chunk model’s semanticSearch method, enabling an authenticated attacker to craft requests that target other users’ file or knowledge‑base identifiers. As a result, the attacker can retrieve text content, file names, and metadata that belong to other users, exposing sensitive data.

The affected product is LobeChat from lobehub. Versions up to and including 2.2.9 are impacted. Any deployment that has not applied the patch found in the commit referenced by the advisory remains vulnerable.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session; the attacker supplies victim identifiers through the chunk retrieval and chat knowledge‑base paths to obtain privileged data. The weakness is classified as CWE‑639, reflecting information disclosure caused by missing authorization checks.