CVE-2024-10366: IDOR in delete attachments in danny-avila/librechat

Published Mar 20, 2025

Updated

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

Affected Software

2 affected components

danny-avila librechat

librechat librechat=0.7.5-rc2

Remediation

Patch Available

https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116

Event History

Mar 20, 2025

CVE Published

via MITRE·10:09 AM

Data Sourced

via MITRE·10:09 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-10366?

CVE-2024-10366 is rated as a high-severity vulnerability due to improper access control in the delete attachments functionality.

How can I fix CVE-2024-10366?

To fix CVE-2024-10366, update to the latest version of LibreChat where the improper access control has been corrected.

What type of vulnerability is CVE-2024-10366?

CVE-2024-10366 is classified as an improper access control vulnerability, specifically an Insecure Direct Object Reference (IDOR).

Which versions of LibreChat are affected by CVE-2024-10366?

CVE-2024-10366 affects LibreChat version v0.7.5-rc2 and possibly earlier versions that utilize the same delete attachments functionality.

Who can exploit CVE-2024-10366?

Any authenticated user can exploit CVE-2024-10366 to delete attachments that do not belong to them due to inadequate verification of attachment ownership.