{
 "id": "AIR-2026-0442",
 "slug": "cve-2026-23835-lobehub-improper-authorization-in-presigned-u",
 "title": "CVE-2026-23835: LobeHub improper authorization in presigned upload",
 "summary": "LobeHub lacks proper validation on file upload requests within its knowledge base feature, allowing users to write files to unintended paths. Attackers can also manipulate request parameters to misrepresent file usage and size quotas.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "LobeHub",
  "LobeChat"
 ],
 "incident_date": "2026-02-01",
 "incident_date_precision": "day",
 "first_reported": "2026-02-01",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-wrrr-8jcv-wjf5",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-23835: LobeHub Vulnerable to Improper Authorization in Presigned Upload",
   "published_at": "2026-02-01"
  }
 ],
 "source_count": 1,
 "confidence": 0.9,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-23835",
  "authorization"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}