In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599 | Patch |
| https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b | Exploit Third Party Advisory |
Configurations
History
11 Jul 2025, 20:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Librechat
Librechat librechat |
|
| CPE | cpe:2.3:a:librechat:librechat:0.7.5:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b - Exploit, Third Party Advisory | |
| References | () https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599 - Patch |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-11 20:09
NVD link : CVE-2024-10363
Mitre link : CVE-2024-10363
JSON object : View
Products Affected
librechat
- librechat
CWE