CVE-2024-24566 - Vulnerability Details - OpenCVE

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Lobehub	Lobe Chat

Configuration 1 [-]

cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37

History

Tue, 17 Jun 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-01-31T16:33:44.129Z

Updated: 2025-06-17T21:29:21.984Z

Reserved: 2024-01-25T15:09:40.210Z

Link: CVE-2024-24566

Vulnrichment

Updated: 2024-08-01T23:19:52.946Z

NVD

Status : Modified

Published: 2024-01-31T17:15:39.173

Modified: 2024-11-21T08:59:26.090

Link: CVE-2024-24566

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24566", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-25T15:09:40.210Z", "datePublished": "2024-01-31T16:33:44.129Z", "dateUpdated": "2025-06-17T21:29:21.984Z"}, "containers": {"cna": {"title": "Lobe Chat unauthorized access to plugins", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37"}, {"name": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "tags": ["x_refsource_MISC"], "url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd"}], "affected": [{"vendor": "lobehub", "product": "lobe-chat", "versions": [{"version": "< 0.122.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-31T16:33:44.129Z"}, "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4."}], "source": {"advisory": "GHSA-pf55-fj96-xf37", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:19:52.946Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37"}, {"name": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-31T19:29:39.876777Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T21:29:21.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "name": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:19:52.946Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-31T19:29:39.876777Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T21:23:38.592Z"}}], "cna": {"title": "Lobe Chat unauthorized access to plugins", "source": {"advisory": "GHSA-pf55-fj96-xf37", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lobehub", "product": "lobe-chat", "versions": [{"status": "affected", "version": "< 0.122.4"}]}], "references": [{"url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "name": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-31T16:33:44.129Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24566", "state": "PUBLISHED", "dateUpdated": "2025-06-17T21:29:21.984Z", "dateReserved": "2024-01-25T15:09:40.210Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-01-31T16:33:44.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "68753204-5FDE-44B0-970E-5F9E4AD01C5A", "versionEndExcluding": "0.122.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4."}, {"lang": "es", "value": "Lobe Chat es un framework de chatbot que admite s\u00edntesis de voz, sistema de complemento de llamada de funci\u00f3n multimodal y extensible. Cuando la aplicaci\u00f3n est\u00e1 protegida con contrase\u00f1a (implementada con la opci\u00f3n `ACCESS_CODE`), es posible acceder a los complementos sin la autorizaci\u00f3n adecuada (sin contrase\u00f1a). Esta vulnerabilidad est\u00e1 parcheada en 0.122.4."}], "id": "CVE-2024-24566", "lastModified": "2024-11-21T08:59:26.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-31T17:15:39.173", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}