Improper Authorization in Conversation Sharing of LibreChat by Danny Avila

CVE-2025-6088

What is CVE-2025-6088?

In version 0.7.8 of LibreChat, improper authorization controls in the conversation sharing feature create a significant security risk. A logged-in user may gain read-only access to other users' private conversations if they know the conversation ID. These IDs, although UUIDv4 format, can be extracted from weakly protected sources like server-side access logs, browser history, or screenshots. The vulnerable API endpoint /api/share/conversationID does not enforce necessary authorization checks, allowing unauthorized access. This issue has been addressed in version 0.7.9-rc1.

References