CVE-2024-11167CWE-639

Improper Access Control in danny-avila/librechat

Critical · published March 20, 2025

CVSS v3.0
9.4
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

The record
Technical detail
CVSS v3.0
9.4 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Improper Access Control in danny-avila/librechat
    cvelistv5