Vulnerability Description
LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librechat | Librechat | >= 0.0.6, < 0.7.8 |
Related Weaknesses (CWE)
References
- https://github.com/danny-avila/LibreChat/commit/0e8041bcac616949c42a68dfb8f108ccPatch
- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-p5j8-m4wh-ffmwExploitVendor Advisory
FAQ
What is CVE-2025-54868?
CVE-2025-54868 is a vulnerability with a CVSS score of 7.5 (HIGH). LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoin...
How severe is CVE-2025-54868?
CVE-2025-54868 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54868?
Check the references section above for vendor advisories and patch information. Affected products include: Librechat Librechat.