CVE-2024-24566: Improper Access Control

January 31, 2024

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the ACCESS_CODE option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.

References

github.com/advisories/GHSA-pf55-fj96-xf37
github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd
github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37
nvd.nist.gov/vuln/detail/CVE-2024-24566

Code Behaviors & Features

Detect and mitigate CVE-2024-24566 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →