Back to Database
Status published
Medium
CVE-2024-24566
Lobe Chat unauthorized access to plugins
Vulnerability Description
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24566
Credits & Attribution
No credits recorded in the NVD database.
References
More from lobehub
View All →CVE-2025-62505
SSRF in lobehub/lobe-chat with native web fetch module
Low
3
CVE-2025-59426
lobe-chat has an Open Redirect
Medium
4.3
CVE-2025-59417
Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Medium
6.8
CVE-2024-47066
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Critical
9
CVE-2024-37895
API Key Leak in lobe-chat
Medium
5.7
Affected Vendor
lobehub
View all reports →Affected Software
lobe-chat
Vulnerable Versions:
< 0.122.4
Timeline
Official Publish:
January 31st, 2024
Last Modified:
June 17th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N