CVE-2024-24566 – Lobe Chat unauthorized access to plugins

https://notcve.org/view.php?id=CVE-2024-24566

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4. Lobe Chat es un framework de chatbot que admite síntesis de voz, sistema de complemento de llamada de función multimodal y extensible. Cuando la aplicación está protegida con contraseña (implementada con la opción `ACCESS_CODE`), es posible acceder a los complementos sin la autorización adecuada (sin contraseña). • https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37 • CWE-284: Improper Access Control •