CVE-2024-11167
9.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Summary
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| danny-avila | danny-avila/librechat | unspecified < 0.7.6 | affected |
Weaknesses
- CWE-639: CWE-639 Authorization Bypass Through User-Controlled Key
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: total
References
- https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0
- https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.