CVE-2025-7106: Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some() to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having CREATE: false permission, as the check for ['USE', 'CREATE'] passes with just USE: true. This vulnerability affects other permission checks as well, such as PROMPTS. The issue is present in all versions prior to the fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7106?
CVE-2025-7106 is considered a critical severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2025-7106?
To fix CVE-2025-7106, ensure proper access control checks are implemented in the `checkAccess` function to validate all required permissions.
What types of systems are affected by CVE-2025-7106?
CVE-2025-7106 affects all versions of the danny-avila/librechat software.
Can CVE-2025-7106 lead to data exposure?
Yes, CVE-2025-7106 can potentially lead to unauthorized data exposure as it bypasses access controls.
What is the root cause of CVE-2025-7106?
The root cause of CVE-2025-7106 is improper access control checks due to flawed logic in the permission validation process.