CVE-2025-69221
⚪ Do wiadomości
Brak odpowiedniej kontroli dostępu w LibreChat pozwala atakującemu na odczytanie uprawnień innych agentów.
CVSS
4.3
EPSS
0.3%
Exploit
poc
Vendor
librechat
Opis źródłowy (NVD)
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 4.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-01-07 21:15:59 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-30 23:10:00 UTC |
Referencje
- https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c ([email protected]) [Patch]
- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2 ([email protected]) [Release Notes]
- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7 ([email protected]) [Exploit, Vendor Advisory]