cve/2024/CVE-2024-24566.md

CVE-2024-24566

Description

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the ACCESS_CODE option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.

POC

Reference

• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37

Github

• https://github.com/dastaj/CVEs
• https://github.com/fkie-cad/nvd-json-data-feeds