CVE-2024-32964 - CVE House
Back to Database
Status published Critical CVE-2024-32964

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Vulnerability Description

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32964

Credits & Attribution

No credits recorded in the NVD database.

References

More from lobehub

View All →
CVE-2025-62505
SSRF in lobehub/lobe-chat with native web fetch module
Low 3
CVE-2025-59426
lobe-chat has an Open Redirect
Medium 4.3
CVE-2025-59417
Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Medium 6.8
CVE-2024-47066
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Critical 9
CVE-2024-37895
API Key Leak in lobe-chat
Medium 5.7

Affected Vendor

Affected Software

lobe-chat
Vulnerable Versions:
<= 0.150.5

Timeline

Official Publish: May 10th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery