Improper Access Control in LibreChat by Danny Avila
CVE-2024-11167
5.3MEDIUM
What is CVE-2024-11167?
An improper access control flaw in LibreChat prior to version 0.7.6 allows authenticated users to manipulate and delete prompts belonging to other users via an insecure groupid parameter. The endpoint fails to validate that the provided prompt ID belongs to the current authenticated user, posing a significant risk of unauthorized data access and modification.
Affected Version(s)
danny-avila/librechat < 0.7.6
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
CVSS V3.0
Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved