Librechat: >> Librechat >> 0.7.5 Security Vulnerabilities
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
CVSS Score
5.4
EPSS Score
0.0
Published
2025-03-20
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
CVSS Score
7.6
EPSS Score
0.0
Published
2025-03-20
Page 2