What’s Vulnerable › Vulnerabilities

CVE-2025-54868: LibreChat exposes arbitrary chats through Meilisearch engine

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-05 · updated 2026-06-17
• Weakness: CWE-285

Description

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.

Affected products

• danny-avila LibreChat: from 0.0.6 before 0.7.8 — fixed in 0.7.8

How to fix

Upgrade to a fixed version: danny-avila LibreChat 0.7.8. Check the vendor advisory for mitigations.

References

• https://github.com/danny-avila/LibreChat/commit/0e8041bcac616949c42a68dfb8f108ccc4db5151
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-p5j8-m4wh-ffmw

Get alerted when CVE-2025-54868 or the next vulnerability affects your stack