Description
knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.143.2
References
Could your website be exposed too?
SmartScanner can check your website for Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings - CVE-2026-32104
- Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941
You might also like:
See something that needs correcting? Let us knowUpdated January 20, 2026