CVE-2024-10366

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

Score

CVSS 3.0 7.6 High

Status

Modified - security@huntr.dev

Published

2025-03-20

Last modified

2025-07-15

Weaknesses

CWE-639

Affected products

• Danny-avilalibrechat (Danny-avila)
• Librechat (Librechat)

References

• https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116
• https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e