CVE-2025-6088 Improper Authorization in danny-avila/librechat

Medium 4.2 Published 11 Sep 2025 Updated 11 Sep 2025

A logged-in user can read other users' conversations by accessing a shared endpoint without proper authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-6088?

CVE-2025-6088 is a medium-severity missing authorization vulnerability in Librechat Librechat, published on 11 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.

Weakness: CWE-285

Which versions are affected by CVE-2025-6088?

It affects 1 product.

Products include Librechat Librechat.

How do I fix CVE-2025-6088?

No fix has been published for CVE-2025-6088 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-6088 being exploited?

There is no known exploitation of CVE-2025-6088 in the wild and no public exploit code.

All Librechat Librechat vulnerabilities

Sources

Also known as GHSA-9g7r-h55w-795g.