PT-2026-45883 · Librechat · Librechat

Aliceqwas · CVE-2026-44654 · Published 2026-06-02 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4

Description A cross-agent integrity violation exists where a shared-agent editor can delete file records globally. By using the "DELETE /api/files" endpoint, an editor can remove files that the owner has reused across multiple agents. This action deletes the file entirely rather than just from the shared agent, causing the owner's private agents to break silently because they retain a stale file id reference that no longer resolves.

Recommendations Update to version 0.8.4.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44654

GHSA-F8JG-V856-MF6Q

Affected Products

Librechat

References · 6

• 🔥 https://github.com/danny-avila/LibreChat/security/advisories/GHSA-f8jg-v856-mf6q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44654.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44654 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44654 · Vendor Advisory
• https://twitter.com/CVEnew/status/2061993198763848065 · Twitter Post
• https://t.me/CVEtracker/55677 · Telegram Post