{"action":"Upgrade @lobehub/chat to 1.143.3 or later.","affected":[{"fixed":"1.143.3","introduced":"0"}],"component":"@lobehub/chat","cve_ids":["CVE-2026-23835"],"ecosystem":"npm","epss":0.00366,"exploited":false,"fixed_versions":["1.143.3"],"ghsa_id":"GHSA-wrrr-8jcv-wjf5","id":"tcs_01M5KGFXJF8JDYPMQGMJPAYT3V","modified_at":"2026-02-03T03:13:45.772943Z","published_at":"2026-02-01T17:39:40Z","references":["https://osv.dev/vulnerability/GHSA-wrrr-8jcv-wjf5","https://github.com/lobehub/lobehub/security/advisories/GHSA-wrrr-8jcv-wjf5","https://nvd.nist.gov/vuln/detail/CVE-2026-23835","https://github.com/lobehub/lobehub/commit/2c1762b85acb84467ed5e799afe1499cd2f912e6","https://github.com/lobehub/lobehub"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-wrrr-8jcv-wjf5","url":"https://osv.dev/vulnerability/GHSA-wrrr-8jcv-wjf5"},{"source":"nvd","source_id":"CVE-2026-23835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23835"}],"summary":"LobeHub Vulnerable to Improper Authorization in Presigned Upload"}