https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 22:25:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-23522 <p><strong>Affected:</strong> lobehub lobe-chat</p> <p>LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. `userId` filter in the database query is commented out, so it&#39;s enabling attackers to delete other users&#39; KB files if they know the knowledge base ID and file ID. While the vulnerability is confirmed, practical exploitation requires knowing target&#39;s KB ID and target&#39;s file ID. These IDs are random and not easily enumerable. However, IDs may leak through shared links, logs, referrer headers and so on. Missing authorization check is a critical security flaw regardless. Users should upgrade to version 2.0.0-next.193 to receive a patch.</p> <p><strong>Affected:</strong> lobehub lobe-chat</p> <p>LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. `userId` filter in the database query is commented out, so it&#39;s enabling attackers to delete other users&#39; KB files if they know the knowledge base ID and file ID. While the vulnerability is confirmed, practical exploitation requires knowing target&#39;s KB ID and target&#39;s file ID. These IDs are random and not easily enumerable. However, IDs may leak through shared links, logs, referrer headers and so on. Missing authorization check is a critical security flaw regardless. Users should upgrade to version 2.0.0-next.193 to receive a patch.</p> https://cve.radiocsirt.org/vuln/cve-2026-23522