LibreChat 0.7.8 Release Candidate 1
Approved changes feed: RSS · Atom
cpe:2.3:a:librechat:librechat:0.7.8:rc1:*:*:*:*:*:*
part: a version: 0.7.8 update: rc1
| Vendor | Librechat (bb616292-ee82-5a16-87fc-6fa13690242e) |
|---|---|
| Product | Librechat (12871d92-73fd-5854-96c7-1c6a934fe8cd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6088 |
vulnerable | 2026-06-08 07:43:14.247619 |
Improper Authorization in danny-avila/librechat
MEDIUM (4.2)
In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.
Published: 2025-09-11T00:43:51.699Z
Updated: 2025-09-11T14:42:34.879Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.