In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 11 Sep 2025 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1. | |
| Title | Improper Authorization in danny-avila/librechat | |
| Weaknesses | CWE-285 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2025-09-11T00:43:51.699Z
Reserved: 2025-06-14T15:10:06.244Z
Link: CVE-2025-6088
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-11T01:15:34.200
Modified: 2025-09-11T01:15:34.200
Link: CVE-2025-6088
Redhat
No data.
OpenCVE Enrichment
No data.