CVE-2024-10366CWE-639

IDOR in delete attachments in danny-avila/librechat

High · published March 20, 2025

CVSS v3.0
7.6
EPSS
0%
Percentile
30.1
In the wild
Unconfirmed
What it is

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

The record
Technical detail
CVSS v3.0
7.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    IDOR in delete attachments in danny-avila/librechat
    cvelistv5