CVE-2024-11167 — Improper Access Control in danny-avila/librechat
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. Th…
Published: 2025-03-20 · CVSS: 9.4 · CVSS 3.0
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7