Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-11167Improper Access Control in danny-avila/librechat
Critical 9.4
In plain English
A critical-severity authorization bypass via user-controlled key in danny-avila/librechat from danny-avila. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.0)9.4Critical
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| danny-avila | danny-avila/librechat | unspecified – before 0.7.6 |
Weakness: CWE-639 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L