CVE-2024-10363

Description

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.

Reserved 2024-10-24 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-284 Improper Access Control

Product status

Any version before 0.7.5
affected

References

huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b

github.com/...ommit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599

cve.org (CVE-2024-10363)

nvd.nist.gov (CVE-2024-10363)

Download JSON