Description

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

Classification

CVE ID: CVE-2024-10366

CVSS Base Severity: HIGH

CVSS Base Score: 7.6

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected Products

Vendor: danny-avila

Product: danny-avila/librechat

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 9.35% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-10366
https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e
https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116

Timeline