LibreChatPublished 20 Mar 2025NVD status: Modified

CVE-2024-11167

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter.

ComponentLibreChat
Severitymedium (CVSS 5.3)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published (NVD)2025-03-20
Last modified2026-06-17
Affected versions
< 0.7.6
from the CVE Program record written by the CNA that assigned the CVE
Fixed in0.7.6
WeaknessCWE-639
CISA KEVnot listed

NVD description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

What to do

  • Upgrade LibreChat to 0.7.6 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources