CVE-2025-69220

Katalog CVE

CVSS 5.9 · Medium EPSS 0,34%

Kerentanan Improper Access Control pada librechat. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-862: Missing Authorization

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59 exploit · advisory vendor
• https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237 patch
• https://cwe.mitre.org/data/definitions/284.html not applicable
• https://cwe.mitre.org/data/definitions/862.html not applicable
• https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2 release notes
• https://owasp.org/Top10/A01_2021-Broken_Access_Control not applicable
• https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorizati... deskripsi teknis
• https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0... deskripsi teknis