CVE-2024-24566: Lobe Chat unauthorized access to plugins

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-31 · updated 2026-06-17
Weakness: CWE-284

Description

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.

Affected products

lobehub lobe-chat: before 0.122.4 — fixed in 0.122.4

How to fix

Upgrade to a fixed version: lobehub lobe-chat 0.122.4. Check the vendor advisory for mitigations.

References

https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37
https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37

Get alerted when CVE-2024-24566 or the next vulnerability affects your stack