LibreChatPublished 11 Sept 2025NVD status: Analyzed

CVE-2025-6088

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known.

ComponentLibreChat
Severitylow (CVSS 3.1)
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Published (NVD)2025-09-11
Last modified2026-06-17
Affected versions
< 0.7.9-rc1
from the CVE Program record written by the CNA that assigned the CVE
Fixed in0.7.9-rc1
WeaknessCWE-285
CISA KEVnot listed

NVD description

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the /api/share/conversationID endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.

What to do

  • Upgrade LibreChat to 0.7.9-rc1 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources