Description
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danny-avila | danny-avila/librechat | unspecified – < 0.7.5 | 0.7.5 |