{"id":"CVE-2024-10366","aliases":["EUVD-2025-7108","GHSA-h5p2-273c-rxjp"],"status":"published","title":"IDOR in delete attachments in danny-avila/librechat","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","severity":{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00374,"percentile":0.31563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-639"],"published":"2025-03-20T10:09:37Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"danny-avila","product":"danny-avila/librechat"},{"vendor":"librechat","product":"librechat"}],"references":[{"url":"https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10366","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h5p2-273c-rxjp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10366.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-10366","title":"IDOR in delete attachments in danny-avila/librechat","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","status":"published","published":"2025-03-20T10:09:37.556Z","modified":"2025-07-15T10:48:56.156Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2025-7108","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","status":"published","published":"2025-03-20T10:09:37Z","modified":"2025-07-15T10:48:56Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:08.210064Z"}],"ghsa":[{"id":"GHSA-h5p2-273c-rxjp","title":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of...","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","status":"published","published":"2025-03-20T12:32:39Z","modified":"2025-07-14T15:31:33Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-284","CWE-639"],"updated_at":"2026-11-02T15:03:00.541352Z"}],"nvd":[{"id":"CVE-2024-10366","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","status":"published","published":"2025-03-20T10:15:16.757Z","modified":"2026-06-17T06:55:29.477Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-10366","title":"IDOR in delete attachments in danny-avila/librechat","description":"An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.","status":"published","published":"2025-03-20T10:09:37.556Z","modified":"2026-10-28T02:30:55.336642542Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:37.180532Z"}]}}