CVE-2024-11167: Improper Access Control in danny-avila/librechat
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11167?
CVE-2024-11167 has been marked as a medium severity vulnerability due to the potential for authenticated users to delete other users' prompts.
How do I fix CVE-2024-11167?
To fix CVE-2024-11167, update to librechat version 0.7.6 or later, which includes a patch for this improper access control issue.
Who is affected by CVE-2024-11167?
CVE-2024-11167 affects authenticated users of librechat versions prior to 0.7.6.
What type of vulnerability is CVE-2024-11167?
CVE-2024-11167 is an improper access control vulnerability that allows users to manipulate prompts they shouldn't be able to access.
Can this vulnerability lead to data loss in CVE-2024-11167?
Yes, CVE-2024-11167 can lead to data loss as it allows one user to delete prompts belonging to another user.