CVE-2026-23522: Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

January 20, 2026

knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership.

References

github.com/advisories/GHSA-j7xp-4mg9-x28r
github.com/lobehub/lobe-chat
github.com/lobehub/lobe-chat/commit/2c1762b85acb84467ed5e799afe1499cd2f912e6
github.com/lobehub/lobe-chat/security/advisories/GHSA-j7xp-4mg9-x28r
nvd.nist.gov/vuln/detail/CVE-2026-23522

Code Behaviors & Features

Detect and mitigate CVE-2026-23522 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →