# CVE-2026-23522: Lobe Chat IDOR in Knowledge Base file removal

Source: https://junglewise.ai/threats/cve-2026-23522-lobe-chat-idor-in-knowledge-base-file-removal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-23522 · Severity: low · CVSS 3.1 · Published 2026-01-20

Lobe Chat is an AI-powered application that uses Knowledge Bases to store documents for retrieval-augmented generation (RAG), which helps the AI provide more accurate and contextualized responses. A missing authorization check in the file deletion function allows an authenticated attacker to delete files from other users' Knowledge Bases if they know the target's Knowledge Base and file IDs, potentially causing loss of important documents and breaking RAG functionality.

Technologies: [@lobehub/chat (npm)](https://junglewise.ai/threats/technologies/lobehub-chat). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-23522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23522 being exploited in the wild.

**How severe is CVE-2026-23522?** Low severity, with a CVSS score of 3.1, published 20 January 2026.

**Which products and versions are affected?** @lobehub/chat (npm) SEMVER:introduced=0,last_affected=1.143.2.

**Is there a fix for CVE-2026-23522?** A patch was published on 2026-01-20: patched in v2.0.0-next.193 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23522 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-23522?** Check whether you run @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the knowledgeBase.removeFilesFromKnowledgeBase tRPC endpoint caused by a commented-out userId filter in the database query. An authenticated attacker can craft a POST request to delete files from any Knowledge Base without verifying ownership. Attack requires knowledge of the target Knowledge Base ID and file ID, and network access to the tRPC endpoint. While IDs are randomly generated and not easily enumerable, they may leak through shared links, logs, or HTTP referrer headers. The patch is available in version v2.0.0-next.193.

## Affected products

- Lobe Lobe Chat <=v2.0.0-next.192

## Identifiers

- CVE-2026-23522
- GHSA-j7xp-4mg9-x28r

## Timeline

- 2026-01-20: disclosed
- 2026-01-20: patched: patched in v2.0.0-next.193

## References

- [https://github.com/lobehub/lobe-chat/security/advisories/GHSA-j7xp-4mg9-x28r](https://github.com/lobehub/lobe-chat/security/advisories/GHSA-j7xp-4mg9-x28r)

## Related threats

- [LobeHub improper authorization in presigned file upload](https://junglewise.ai/threats/cve-2026-23835-lobehub-improper-authorization-in-presigned-file-upload)
- [Lobe Chat stored XSS in Mermaid artifact renderer escalating to RCE](https://junglewise.ai/threats/cve-2026-23733-lobe-chat-stored-xss-in-mermaid-artifact-renderer-escalating-to)
- [Lobe Chat server-side request forgery in web crawler](https://junglewise.ai/threats/cve-2025-62505-lobe-chat-server-side-request-forgery-in-web-crawler)
- [lobe-chat open redirect via X-Forwarded-Host header](https://junglewise.ai/threats/cve-2025-59426-lobe-chat-open-redirect-via-x-forwarded-host-header)
- [Lobe Chat Desktop XSS to RCE in SVG artifact rendering](https://junglewise.ai/threats/cve-2025-59417-lobe-chat-desktop-xss-to-rce-in-svg-artifact-rendering)