CVE-2024-24566mediumCWE-284

CVE-2024-24566: falha de média gravidade em lobehub lobe-chat

Lobe Chat unauthorized access to plugins

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar lobe-chat+ Monitorar @lobehub/chat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
lobehub · lobe-chat
CVEs relacionadas — lobehub lobe-chat

No mesmo produto, das mais perigosas para as menos.

CVE-2024-32964CRITICALlobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilityEPSS 53.0%CVE-2024-32965HIGHssrf vulnerability in lobe-chatEPSS 26.1%CVE-2024-47066CRITICALLobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)EPSS 11.9%CVE-2024-37895MEDIUMAPI Key Leak in lobe-chatEPSS 0.5%CVE-2025-59417MEDIUMLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesEPSS 0.4%CVE-2026-23835MEDIUMLobeHub Vulnerable to Improper Authorization in Presigned UploadEPSS 0.4%