Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Classification

CVE ID: CVE-2024-11167

CVSS Base Severity: CRITICAL

CVSS Base Score: 9.4

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Products

Vendor: danny-avila

Product: danny-avila/librechat

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.06% (probability of being exploited)

EPSS Percentile: 17.47% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-11167
https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0
https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7

Timeline