Authorization Bypass in LibreChat by danny-avila

CVE-2025-7106

What is CVE-2025-7106?

LibreChat, developed by danny-avila, is susceptible to an authorization bypass due to flawed access control mechanisms. The vulnerability arises in the checkAccess function within the api/server/middleware/roles/access.js file, where the permissions validation logic incorrectly allows users with insufficient privileges to create agents. Specifically, if a user possesses only the 'USE' permission without the required 'CREATE' permission, the system erroneously permits agent creation. This issue complicates other permission validations as well, potentially exposing the application to elevated risk. All versions of LibreChat prior to the release of the fix are affected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References