CVE-2025-69221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69221
Aliases
  • GHSA-5ccx-4r3h-9qc7
Related
Published
2026-01-07T21:01:13.918Z
Modified
2026-07-15T01:48:52.405243617Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
LibreChat has Insufficient Access Control for Agent Permission Queries
Details

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69221.json"
}
References

Affected packages

Git / github.com/danny-avila/librechat

Affected ranges

Type
GIT
Repo
https://github.com/danny-avila/librechat
Events
Introduced
b288d81f5a4625403bc880e93059d90d9aa51fe3
Fixed
06ba025bd95574c815ac6968454be7d3b024391c
Fixed
24e8a258cd8fa1ff42c02cf15408079f1dbe07b0
Database specific 
{
    "cpe": [
        "cpe:2.3:a:librechat:librechat:0.8.1:-:*:*:*:*:*:*",
        "cpe:2.3:a:librechat:librechat:0.8.1:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0.8.1-NA"
        },
        {
            "last_affected": "0.8.1-NA"
        },
        {
            "introduced": "0.8.1-rc1"
        },
        {
            "last_affected": "0.8.1-rc1"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.8.1-NA
0.8.1-rc1
chart-1.*
chart-1.9.4
v0.*
v0.8.1
v0.8.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69221.json"