CVE-2024-10366

Published: Mar 20, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

Affected (1)

Products: Librechat: Librechat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Librechat Librechat	Version 0.7.5 rc2

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116

Source: security@huntr.dev

Patch

https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.