danny-avila LibreChat up to 0.8.4 Id Endpoint /api/messages authorization

Summaryinfo

A vulnerability was found in danny-avila LibreChat. It has been classified as problematic. This vulnerability affects unknown code of the file /api/messages of the component Id Endpoint. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2026-54029. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in danny-avila LibreChat. This affects an unknown code block of the file /api/messages of the component Id Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity. The summary by CVE is:

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim's messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54029 since 06/11/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.8.4-rc1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• danny-avila

Name

• LibreChat

Version

• 0.7.5
• 0.7.6
• 0.7.7
• 0.7.8
• 0.7.9
• 0.7.9-rc1
• 0.8.0-rc2
• 0.8.1
• 0.8.1-rc2
• 0.8.2
• 0.8.2-rc2
• 0.8.2-rc3
• 0.8.3
• 0.8.3-rc1
• 0.8.3-rc2
• 0.8.4

Website

• Product: https://github.com/danny-avila/LibreChat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion