The vulnerability in LobeChat through version 2.2.9 is a broken object level authorization issue (CWE-639) that enables authenticated users to bypass user-scoped access controls. By providing arbitrary group identifiers, attackers can perform unauthorized actions on chat-group agent data of other users, including reading agent listings, changing agent roles and order, and removing agents from groups. This flaw affects the getGroupAgents, updateAgentInGroup, and removeAgentsFromGroup operations. No patch or remediation information is provided, and no known exploits are reported in the wild.

Authenticated attackers can access and manipulate chat-group agent data of other users, potentially leading to unauthorized disclosure, modification, or removal of agents within chat groups. This compromises the integrity and confidentiality of group agent data but requires authentication and has a low severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for suspicious activity related to group agent operations. Avoid sharing group identifiers with untrusted parties.