CVE-2024-10366 — IDOR in delete attachments in danny-avila/librechat
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether …
Published: 2025-03-20 · CVSS: 7.6 · CVSS 3.0
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7