CVE-2024-11167

EUVD-2025-7052
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
@huntr_aiCNA
9.4 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
librechatlibrechat
𝑥
< 0.7.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7
https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0