Authorization Bypass in LibreChat by danny-avila

CVE-2025-7106

What is CVE-2025-7106?

LibreChat, developed by danny-avila, is susceptible to an authorization bypass due to flawed access control mechanisms. The vulnerability arises in the checkAccess function within the api/server/middleware/roles/access.js file, where the permissions validation logic incorrectly allows users with insufficient privileges to create agents. Specifically, if a user possesses only the 'USE' permission without the required 'CREATE' permission, the system erroneously permits agent creation. This issue complicates other permission validations as well, potentially exposing the application to elevated risk. All versions of LibreChat prior to the release of the fix are affected.

References