Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2024-11167: Authenticated users can delete other users' messages in Librechat
CVE-2024-11167 · published 1 year ago
Summary
Authenticated users in Librechat versions prior to 0.7.6 can delete messages from other users. This could lead to important information being deleted or conversations being disrupted. Update to version 0.7.6 or later to fix this issue.
What to do
- Update librechat librechat to version 0.7.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| librechat | librechat |
< 0.7.6 cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* |
Original advisory text
Improper Access Control in danny-avila/librechat
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
References
- https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11167... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11167 Vendor Advisory
- https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published20 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta