CVE-2024-11167

5.3 mediumEPSS 0.6%

Medium (5.3) in librechat librechat. EPSS 0.6% chance of exploitation in the next 30 days.

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librechat:librechat

References

https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7
https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0

Check your stack JSON