shouldiuse.io

Categories

VERDICT

LobeHub Review

Depends

Should I use LobeHub?

The ultimate space for work and life: to find, build, and collaborate with agent teammates that grow with you. - lobehub.com

· 1 month ago

Buy if you're a technical tinkerer or indie builder who wants a free, self-hostable multi-agent workspace and will patch CVEs quickly. Skip it if you handle sensitive data or need vendor support, SLAs, and security sign-off.

Confidence

Medium. Based on 30+ public sources; many snippets truncated, and no named enterprise customers found in evidence.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo direct support evidence in sources
  • Security posture

Pricing

$0/mo

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid cloud plans$9.90–39.90/mo

Best for

  • AI hobbyists and tinkerers
  • Self-hosting developers
  • Indie builders chaining agents
  • Prompt-engineering power users

Not for

  • Enterprises needing SOC2 sign-off and vendor SLAs
  • Non-technical teams wanting zero setup
  • Anyone handling sensitive customer data
  • Buyers expecting hand-holding support

Gotchas - check before you buy

high

Unauthenticated SSRF in /webapi/proxy — patch immediately if self-hosting

high

XSS vulnerabilities escalate to remote code execution

medium

Reddit users guess at what credits cover; expect billing surprises

medium

Agent sync breaks between PC and mobile per open GitHub issue

Pros and cons

Pros

  • Open-source with 80K+ GitHub stars; self-hostable
  • Massive agent/skill marketplace plus MCP servers and mobile apps
  • Free cloud tier and low-cost paid plans
  • Users claim it beats Manus and Claude Cowork on speed and price
  • iOS and Android apps included

Cons

  • Four-plus serious CVEs disclosed in 2026
  • PC-to-mobile agent sync reported broken
  • Heavy setup; one user spent two weeks organizing knowledge bases
  • Tiny community: subreddit has only 207 subscribers
  • Credit system opaque; users unsure what credits cover

Sources & method

- 16 sources - Multiple high-severity CVEs disclosed in 2026, including unauthenticated SSRF and XSS-to-RCE; patch fast if self-hosting.

official x4review x6security x4news x2
  • Unauthenticated SSRF in /webapi/proxy, CVE-2026-54157 affects the proxy endpoint on.com, enabling server-side request forgery without authentication.
  • XSS escalating to remote code execution, GitHub advisory GHSA-xq4x-622m-q8fq: cross-site scripting escalates to RCE; verified by the LobeChat team.
  • Broken object-level authorization in chat groups, CVE-2026-59100 in version 2.2.9 allows unauthorized chat-group and agent operations.
  • Stored XSS vulnerability, CVE-2026-72594 is a stored XSS vulnerability in LobeHub.

Key stats

  • Value for money: 4/5

    Rating

  • $0/mo

    Starting price

  • 16

    Sources

  • Analyzed

  • Value for money: 4/5. Free tier, open source, cheap cloud plans
  • Ease of use: 2/5. Setup-heavy; sync bugs reported
  • Feature depth: 5/5. 273K-skill hiring pool, MCP, mobile apps
  • Support quality. No direct support evidence in sources
  • Security posture: 2/5. Repeated high-severity CVEs disclosed in 2026
  • 80K+ GitHub stars Open-source community size
  • $9.90/mo Starting price Cloud plans up to $39.90/mo
  • Yes Free tier Free cloud credits + self-hosting
  • $0 raised Funding Per Tracxn company profile

Pricing

Free

$0/mo

  • Free cloud credits
  • Basic agent access

Paid cloud plans

$9.90–39.90/mo

  • Higher usage limits
  • Cloud + mobile sync

Security

Multiple high-severity CVEs disclosed in 2026, including unauthenticated SSRF and XSS-to-RCE; patch fast if self-hosting.

  • Unauthenticated SSRF in /webapi/proxyCVE-2026-54157 affects the proxy endpoint on.com, enabling server-side request forgery without authentication.10
  • XSS escalating to remote code executionGitHub advisory GHSA-xq4x-622m-q8fq: cross-site scripting escalates to RCE; verified by the LobeChat team.11
  • Broken object-level authorization in chat groupsCVE-2026-59100 in version 2.2.9 allows unauthorized chat-group and agent operations.12
  • Stored XSS vulnerabilityCVE-2026-72594 is a stored XSS vulnerability in LobeHub.13

What users say

Power users praise the depth and value but report heavy setup effort and occasional sync bugs.

“Wow. How have I not heard of this one”
Reddit, r/ClaudeAI
“I spent 2 weeks organizing my knowledge bases in ...”
Reddit, r/LobeHub
“Better, faster, and cheaper than Manus and Clau...”
Facebook group post

Alternatives

Compare LobeHub with each alternative.

  • Cherry Studio

    Simpler desktop LLM client, less setup

  • LibreChat

    Mature self-hosted chat UI, multi-provider

  • OpenWebUI

    Popular local-first web UI for models

    LobeHub vs OpenWebUI

  • AnythingLLM

    Simple all-in-one local document chat

Full analysis

Based on 30+ public sources; many snippets truncated, and no named enterprise customers found in evidence.

Powerful open-source multi-agent workspace, but 2026 CVEs and heavy setup make it a tinkerer's tool, not an enterprise one.

Methodology

Based on 30+ public sources; many snippets truncated, and no named enterprise customers found in evidence.

Read how a report is made.

Sources

  1. LobeHub — official sitelobehub.com
    official
  2. LobeHub Pricinglobehub.com
    official
  3. Can LobeHub be used for free?lobehub.com
    official
  4. LobeHub on GitHubgithub.com
    official
  5. LobeHub — Your Chief Agent Operator (Product Hunt)producthunt.com
    review
  6. LobeHub review video — 80K+ GitHub starsyoutube.com
    review
  7. Reddit: 2 weeks organizing knowledge basesreddit.com
    review
  8. Reddit: year-long LobeHub userreddit.com
    review
  9. Facebook: faster and cheaper than Manusfacebook.com
    review
  10. Unauthenticated SSRF advisory (CVE-2026-54157)github.com
    security
  11. XSS-to-RCE advisory (GHSA-xq4x-622m-q8fq)github.com
    security
  12. Broken object-level authorization (CVE-2026-59100)vulncheck.com
    security
  13. Stored XSS (CVE-2026-72594)sentinelone.com
    security
  14. LobeChat alternatives and pricing — Sliplanesliplane.io
    news
  15. LobeHub company profile — Tracxntracxn.com
    news
  16. Agent sync issue between PC and mobilegithub.com
    review

Add this review to your site

This check for LobeHub says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends LobeHub Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.