CVE-2025-54868: LibreChat exposes arbitrary chats through Meilisearch engine
LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54868?
CVE-2025-54868 has been assigned a moderate severity level due to the exposure of sensitive chat data.
How do I fix CVE-2025-54868?
To remediate CVE-2025-54868, upgrade LibreChat to version 0.7.8 or later where the exposed endpoint has been secured.
What systems are affected by CVE-2025-54868?
CVE-2025-54868 affects LibreChat versions from 0.0.6 up to 0.7.7-rc1.
What kind of data can be accessed due to CVE-2025-54868?
CVE-2025-54868 allows unauthorized access to arbitrary chats stored in the Meilisearch engine.
Is there a method provided by LibreChat for dealing with CVE-2025-54868?
LibreChat has not provided a direct method to mitigate CVE-2025-54868 other than upgrading to the fixed version.