Vulnerability Description
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librechat | Librechat | < 0.7.6 |
Related Weaknesses (CWE)
References
- https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851fPatch
- https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0ExploitThird Party Advisory
FAQ
What is CVE-2024-11167?
CVE-2024-11167 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because...
How severe is CVE-2024-11167?
CVE-2024-11167 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-11167?
Check the references section above for vendor advisories and patch information. Affected products include: Librechat Librechat.