CVE-2026-58580: LobeChat Authorization Bypass Allows Message Tampering

Technical summary

CVE-2026-58580 exploits broken object-level authorization in LobeChat's MessageModel implementation. Five mutation methods—updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate—filter target rows by message ID alone, omitting the userId scope present in sibling methods. The findMessagePlugin query is similarly unscoped. These methods are exposed via tRPC message procedures, allowing an authenticated user to craft requests that modify records belonging to other users. The vulnerability stems from incomplete authorization checks rather than missing authentication; the attacker must already be a valid user on the instance and must know the victim's message ID, which is not enumerable.

Business impact

Multi-tenant LobeChat deployments risk data integrity violations where users can corrupt one another's AI plugin interactions and translations. While confidentiality impact is limited (the attacker learns only what they already had visibility to), the integrity breach could undermine trust in message fidelity and plugin reliability. For organizations using LobeChat as a shared knowledge or customer-facing tool, adversarial tampering of translations or plugin outputs could have operational or reputational consequences. The attack surface is restricted to authenticated users with knowledge of specific message IDs, reducing blast radius but not eliminating the risk in competitive or adversarial environments.

Affected systems

LobeChat server-database deployments through version 2.2.9 are vulnerable. The issue affects the tRPC message API surface and any integration relying on MessageModel mutations. Deployments where users cannot enumerate message IDs (e.g., through access controls or architectural isolation) see reduced practical risk, but the flaw exists in the codebase regardless. Verify against LobeChat's official advisory for patched versions and whether upgrades require database migration or deployment reconfiguration.

Exploitability

Exploitation requires: (1) valid authentication as a user on the target LobeChat instance, (2) knowledge of a victim's message ID (non-enumerable but discoverable through various means—logs, timing attacks, or social engineering), and (3) ability to call tRPC mutation endpoints. The CVSS score of 5.9 (MEDIUM) reflects the authentication requirement and the need for specific message ID knowledge, which raises the attack complexity. However, once a message ID is known, modification is trivial and leaves no obvious audit trail to the victim. The vulnerability is not exploited in the wild according to available threat intelligence, and LobeChat has not been added to the CISA KEV catalog.

Remediation

Upgrade LobeChat to a patched version that restores userId filtering across all MessageModel mutation and query methods. Review the patch to ensure all five affected methods—updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, updateTranslate—and the findMessagePlugin query include proper user scope checks. After upgrade, perform regression testing on plugin workflows, state management, and translation features to confirm functionality is preserved. If running a multi-tenant instance, consider adding application-level audit logging for message modifications to detect tampering in the field.

Patch guidance

Consult the LobeChat project repository and release notes for version numbers that address CVE-2026-58580. Patches should add userId filtering to the five vulnerable methods and the findMessagePlugin query, ensuring queries return only rows owned by the authenticated user. Deployment best practice: test the patched version in a staging environment mirroring your production setup before promoting to production, especially if you use custom plugins or rely on plugin state persistence. Verify that no message data is lost or corrupted during the upgrade and that cross-tenant boundaries are properly enforced post-patch.

Detection guidance

Monitor tRPC message procedure calls (updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, updateTranslate) for requests where the authenticated user ID does not match the owner of the target message. Log and alert on any such mismatch. If you have access to application logs or database audit trails, search for update operations on message plugin or translation records where the user performing the update is not the message owner. Network-level detection is difficult without inspection of tRPC payloads; focus detection at the application layer. After patching, these operations should fail silently or return an error, so baseline your systems and alert on unexpected permission denials.

Why prioritize this

Prioritize this vulnerability for environments where LobeChat is shared among multiple users or teams. The MEDIUM CVSS score appropriately reflects the authentication barrier and non-enumerable message ID requirement, but the integrity impact on shared message metadata justifies timely patching. Organizations using LobeChat in competitive, customer-facing, or compliance-heavy contexts should treat this as high priority; development teams using LobeChat for internal knowledge management may defer slightly. The absence of public exploits and KEV status does not diminish the need to patch; the risk is real for multi-tenant deployments.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) is assigned under the CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N vector. Network-accessible (AV:N) and unauthenticated users are blocked (PR:L). Attack complexity is high (AC:H) because the attacker must know a non-enumerable message ID. Confidentiality is low (C:L) because the attacker gains no new information beyond what the message's content already reveals. Integrity is high (I:H) because the attacker can arbitrarily modify plugin metadata, state, and translations. Availability is not impacted (A:N). The high integrity impact is tempered by the restricted scope (single user's messages, not global system state), keeping the overall score in the MEDIUM band.

Frequently asked questions