Vulnerability Description
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librechat | Librechat | 0.8.1 |
Related Weaknesses (CWE)
References
- https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3Patch
- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2Release Notes
- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7ExploitVendor Advisory
FAQ
What is CVE-2025-69221?
CVE-2025-69221 is a vulnerability with a CVSS score of 4.3 (MEDIUM). LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of a...
How severe is CVE-2025-69221?
CVE-2025-69221 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-69221?
Check the references section above for vendor advisories and patch information. Affected products include: Librechat Librechat.