CVE-2024-11167 Information

Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users’ prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Reference

https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7 https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0