CVE-2024-10363: Improper Access Control in danny-avila/LibreChat

Published Mar 20, 2025

Updated

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.

Affected Software

2 affected components

danny-avila librechat

librechat librechat=0.7.5

Remediation

Patch Available

https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-10363?

CVE-2024-10363 is classified as a high severity vulnerability due to improper access control which can lead to unauthorized actions.

How do I fix CVE-2024-10363?

To fix CVE-2024-10363, ensure that proper access controls are implemented to restrict user permissions for sharing, using, and creating prompts.

What software is affected by CVE-2024-10363?

CVE-2024-10363 affects version 0.7.5 of danny-avila/LibreChat.

What type of vulnerability is CVE-2024-10363?

CVE-2024-10363 is an improper access control vulnerability allowing unauthorized actions within the application.

Can CVE-2024-10363 be exploited easily?

Yes, CVE-2024-10363 can be easily exploited due to the lack of permissions checks on prompt actions.