CVE-2026-54027

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5	Exploit Vendor Advisory
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) LibreChat es un clon mejorado de ChatGPT que soporta múltiples proveedores de IA. Antes de 0.8.4-rc1, el endpoint POST /api/files/images permite a cualquier usuario autenticado subir archivos a los tool_resources de cualquier agente (por ejemplo, context, execute_code) sin verificar la propiedad o el permiso de EDICIÓN en el agente objetivo. Se añadió una verificación de permisos a la ruta POST /api/files en un parche anterior, pero la ruta de subida de imágenes nunca se actualizó con la misma verificación. Un atacante puede simplemente usar el endpoint de imágenes en lugar del endpoint de archivos para eludir la autorización por completo. Esta vulnerabilidad está corregida en 0.8.4-rc1.

Information

Published : 2026-06-25 17:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-54027

Mitre link : CVE-2026-54027

CVE.ORG link : CVE-2026-54027

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-54027", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54027", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T15:20:33.829289Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.4-rc1"}]}]}], "published": "2026-06-25T17:16:40.397", "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1."}, {"lang": "es", "value": "LibreChat es un clon mejorado de ChatGPT que soporta m\u00faltiples proveedores de IA. Antes de 0.8.4-rc1, el endpoint POST /api/files/images permite a cualquier usuario autenticado subir archivos a los tool_resources de cualquier agente (por ejemplo, context, execute_code) sin verificar la propiedad o el permiso de EDICI\u00d3N en el agente objetivo. Se a\u00f1adi\u00f3 una verificaci\u00f3n de permisos a la ruta POST /api/files en un parche anterior, pero la ruta de subida de im\u00e1genes nunca se actualiz\u00f3 con la misma verificaci\u00f3n. Un atacante puede simplemente usar el endpoint de im\u00e1genes en lugar del endpoint de archivos para eludir la autorizaci\u00f3n por completo. Esta vulnerabilidad est\u00e1 corregida en 0.8.4-rc1."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77B80F25-E7C2-442E-98E3-F4462C40C74F", "versionEndIncluding": "0.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}