{"id":"CVE-2025-6088","aliases":["EUVD-2025-27623","GHSA-9g7r-h55w-795g"],"status":"published","title":"Improper Authorization in danny-avila/librechat","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","severity":{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00311,"percentile":0.24287,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2025-09-11T00:43:51Z","modified":"2026-10-28T02:30:39Z","products":[{"vendor":"danny-avila","product":"danny-avila/librechat"},{"vendor":"librechat","product":"librechat"}],"references":[{"url":"https://huntr.com/bounties/361405bb-a739-41eb-a680-4cb6193e7c76","tags":["Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/danny-avila/librechat/commit/3af2666890bbf291cb7b9f3e03592d54714f0ff5","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6088","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9g7r-h55w-795g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6088.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-6088","title":"Improper Authorization in danny-avila/librechat","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","status":"published","published":"2025-09-11T00:43:51.699Z","modified":"2025-09-11T14:42:34.879Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:32:40.419293Z"}],"euvd":[{"id":"EUVD-2025-27623","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","status":"published","published":"2025-09-11T00:43:51Z","modified":"2025-09-11T14:42:34Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:44.524108Z"}],"ghsa":[{"id":"GHSA-9g7r-h55w-795g","title":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation...","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","status":"published","published":"2025-09-11T03:30:54Z","modified":"2025-09-11T03:30:55Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:03:34.267891Z"}],"nvd":[{"id":"CVE-2025-6088","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","status":"published","published":"2025-09-11T01:15:34.2Z","modified":"2026-06-17T10:01:07.7Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"CVE-2025-6088","title":"Improper Authorization in danny-avila/librechat","description":"In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.","status":"published","published":"2025-09-11T00:43:51.699Z","modified":"2026-10-28T02:30:39.503384807Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:44:51.516975Z"}]}}