{"id":"CVE-2024-11167","aliases":["EUVD-2025-7052","GHSA-jw8w-84x3-c2r9"],"status":"published","title":"Improper Access Control in danny-avila/librechat","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","severity":{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00559,"percentile":0.47009,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-639"],"published":"2025-03-20T10:09:49Z","modified":"2026-10-28T02:31:09Z","products":[{"vendor":"danny-avila","product":"danny-avila/librechat"},{"vendor":"librechat","product":"librechat"}],"references":[{"url":"https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11167","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jw8w-84x3-c2r9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11167.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-11167","title":"Improper Access Control in danny-avila/librechat","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","status":"published","published":"2025-03-20T10:09:49.1Z","modified":"2025-07-15T10:48:56.854Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2025-7052","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","status":"published","published":"2025-03-20T10:09:49Z","modified":"2025-07-15T10:48:56Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T20:32:08.210064Z"}],"ghsa":[{"id":"GHSA-jw8w-84x3-c2r9","title":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows...","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","status":"published","published":"2025-03-20T12:32:41Z","modified":"2025-07-14T15:31:33Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-284","CWE-639"],"updated_at":"2026-11-02T15:03:00.541352Z"}],"nvd":[{"id":"CVE-2024-11167","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","status":"published","published":"2025-03-20T10:15:24.097Z","modified":"2026-06-17T06:57:11.957Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-11167","title":"Improper Access Control in danny-avila/librechat","description":"An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.","status":"published","published":"2025-03-20T10:09:49.1Z","modified":"2026-10-28T02:31:09.376960057Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:37.180532Z"}]}}