CVE-2025-69220

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/284.html	Not Applicable
https://cwe.mitre.org/data/definitions/862.html	Not Applicable
https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237	Patch
https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2	Release Notes
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59	Exploit Vendor Advisory
https://owasp.org/Top10/A01_2021-Broken_Access_Control	Not Applicable
https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html	Technical Description
https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf	Technical Description

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:librechat:librechat:0.8.1:-::::::
	cpe:2.3:a:librechat:librechat:0.8.1:rc1::::::

History

No history.

Information

Published : 2026-01-07 21:15

Updated : 2026-01-15 21:44

NVD link : CVE-2025-69220

Mitre link : CVE-2025-69220

CVE.ORG link : CVE-2025-69220

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-284

Improper Access Control

CWE-862

Missing Authorization

{"id": "CVE-2025-69220", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2026-01-07T21:15:59.547", "references": [{"url": "https://cwe.mitre.org/data/definitions/284.html", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://cwe.mitre.org/data/definitions/862.html", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html", "tags": ["Technical Description"], "source": "security-advisories@github.com"}, {"url": "https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf", "tags": ["Technical Description"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2."}], "lastModified": "2026-01-15T21:44:57.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.8.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98BB9E92-2D0E-4975-A966-734F3858551B"}, {"criteria": "cpe:2.3:a:librechat:librechat:0.8.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DAB7F45-699A-4383-ABEA-D4374E58EE95"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}