CVE-2024-11167: Improper Access Control in danny-avila/librechat

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-639

Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Affected products

danny-avila LibreChat: before 0.7.6 — fixed in 0.7.6

How to fix

Upgrade to a fixed version: danny-avila LibreChat 0.7.6. Check the vendor advisory for mitigations.

References

https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7
https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0

Get alerted when CVE-2024-11167 or the next vulnerability affects your stack