CVE-2024-11167

Improper Access Control in danny-avila/librechat

State: Published
Severity: 9.4 Critical
Published: Mar 20, 2025
Updated: Jul 15, 2025
Reserved: Nov 12, 2024

Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Scores

CVSS	Score	Vector	Source
3.0	9.4 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	@huntr_ai

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
danny-avila/librechatdanny-avila	before 0.7.6Affected

References

https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0
https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.