CVE-2024-10363 MEDIUM

CVE-2024-10363: Improper Access Control in danny-avila/LibreChat

Vendor Danny-Avila
Product danny-avila/librechat
Weakness CWE-862 · Missing authorization
Published March 20, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
October 15, 2025 Record updated