CVE-2024-11167criticalCWE-639

CVE-2024-11167: critical vulnerability in danny-avila/librechat

Improper Access Control in danny-avila/librechat

Published · Updated

Follow this CVE+ Monitor danny-avila/librechat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.6%
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
danny-avila · danny-avila/librechat
Related CVEs — danny-avila/librechat

In the same product, most dangerous first.

CVE-2024-11170HIGHPath Traversal in danny-avila/librechatEPSS 1.8%CVE-2024-10361HIGHArbitrary File Deletion via Path Traversal in danny-avila/librechatEPSS 1.0%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2024-11169HIGHUnhandled Exception Leading to Server Crash in danny-avila/librechatEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2024-11171HIGHImproper Input Validation in danny-avila/librechatEPSS 0.5%