PT-2025-12099 · Librechat · Librechat

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-11167

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6

Description The issue is related to improper access control, allowing authenticated users to delete other users' prompts. This occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user, specifically via the groupid parameter.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the endpoint that handles prompt deletion to prevent unauthorized modifications. Avoid using the groupid parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2024-11167

Affected Products

Librechat

References · 7

• 🔥 https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0 · Exploit
• https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-11167 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11167 · Vendor Advisory
• https://t.me/cvenotify/128975 · Telegram Post
• https://t.me/cvenotify/128853 · Telegram Post
• https://twitter.com/CVEnew/status/1902968868148220100 · Twitter Post