PT-2025-12039 · Librechat · Librechat

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-10363

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions danny-avila/LibreChat version 0.7.5

Description The issue is related to improper access control, allowing users to share, use, and create prompts without permission from the admin. This can lead to unauthorized actions and break application logic and permissions.

Recommendations For version 0.7.5, consider restricting user permissions to create, share, and use prompts until a proper access control mechanism is implemented to require admin permission for these actions.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-10363

Affected Products

Librechat

References · 5

• 🔥 https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b · Exploit
• https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10363 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10363 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671133649809667 · Twitter Post