The vulnerability in LobeChat versions up to 2.2.9 involves broken object-level authorization in the MessageModel. Specifically, the updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter database rows solely by message ID, omitting user ID scoping that sibling methods enforce. Additionally, the findMessagePlugin method reads data by ID alone. These methods are accessible via corresponding tRPC message procedures. An authenticated attacker who knows another user's message ID can overwrite that user's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance. The victim then receives the tampered content. Exploitation requires knowledge of the victim's message identifier, which is non-enumerable.

An authenticated attacker with knowledge of a victim's message identifier can overwrite the victim's plugin-related metadata and records, potentially causing data integrity issues and misleading or corrupted content being served to the victim. This impacts the confidentiality and integrity of user-specific plugin data within the LobeChat application. There is no indication of privilege escalation or remote unauthenticated exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to authenticated users and consider limiting exposure of message identifiers to reduce the risk of exploitation.