CVE-2024-11167 | THREATINT

Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Reserved 2024-11-12 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

CRITICAL: 9.4CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Problem types

CWE-284 Improper Access Control

Product status

Any version before 0.7.6

affected

References

huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0

github.com/...ommit/5071bdbf9ac621165f0e8d009818851f3951eee7

cve.org (CVE-2024-11167)

nvd.nist.gov (CVE-2024-11167)

Download JSON