CVE-2024-10363mediumCWE-862

CVE-2024-10363: medium-severity vulnerability in danny-avila/librechat

Improper Access Control in danny-avila/LibreChat

Published · Updated

Follow this CVE+ Monitor danny-avila/librechat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.4%
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
danny-avila · danny-avila/librechat
Related CVEs — danny-avila/librechat

In the same product, most dangerous first.

CVE-2024-11170HIGHPath Traversal in danny-avila/librechatEPSS 1.8%CVE-2024-10361HIGHArbitrary File Deletion via Path Traversal in danny-avila/librechatEPSS 1.0%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2024-11169HIGHUnhandled Exception Leading to Server Crash in danny-avila/librechatEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2024-11167CRITICALImproper Access Control in danny-avila/librechatEPSS 0.6%