← Back

CVE-2025-69220

nvd nist
Published: Jan 7, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.

Affected (2)

Products: Librechat: Librechat
Librechat
1 product
Librechat
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Librechat
Librechat
Version 0.8.1
Librechat
Version 0.8.1 rc1

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (8)

Source: security-advisories@github.com
Not Applicable
Source: security-advisories@github.com
Not Applicable
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
ExploitVendor Advisory
Source: security-advisories@github.com
Not Applicable
Source: security-advisories@github.com
Technical Description
Source: security-advisories@github.com
Technical Description

Timeline

No history available yet.