{
 "id": "AIR-2026-0435",
 "slug": "cve-2026-23522-lobe-chat-idor-vulnerability-in-knowledge-bas",
 "title": "CVE-2026-23522: Lobe Chat IDOR Vulnerability in Knowledge Base File Removal",
 "summary": "An insecure direct object reference vulnerability in Lobe Chat's knowledge base endpoint allows authenticated users to delete files belonging to other users. The database query fails to properly enforce user ownership filters during file removal.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Lobe Chat"
 ],
 "incident_date": "2026-01-20",
 "incident_date_precision": "day",
 "first_reported": "2026-01-20",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-j7xp-4mg9-x28r",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-23522: Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion",
   "published_at": "2026-01-20"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-23522",
  "idor"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}