Unauthorized Message Deletion in LibreChat by Danny Avila

CVE-2026-54029

What is CVE-2026-54029?

In LibreChat, a significant access control issue exists allowing authenticated users to delete messages belonging to other users. The vulnerability arises when the DELETE /api/messages/:conversationId/:messageId endpoint is exploited. Although the validateMessageReq middleware checks that the conversationId belongs to the requesting user, it fails to enforce any user-specific restrictions on the messageId. Consequently, an attacker can bypass this validation by using their own conversationId and targeting another user's messageId, leading to unauthorized and permanent deletion of messages. This issue has been addressed in version 0.8.4-rc1.

References