CVE-2024-10363

5.4 mediumEPSS 0.4%

Medium (5.4) in librechat librechat. EPSS 0.4% chance of exploitation in the next 30 days.

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librechat:librechat

References

https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599
https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b

Check your stack JSON