CVE-2025-69221Medium· 4.3▾ SunlitLibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.
librechat = 0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-69220High· 7.1LibreChat is a ChatGPT clone with additional features
CVE-2025-7106Medium· 5.3danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks
CVE-2025-69222Critical· 9.1LibreChat is a ChatGPT clone with additional features
CVE-2025-7104High· 7.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions
CVE-2025-8848Medium· 5.4A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header
CVE-2025-8849High· 7.5LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint