CVE-2024-10366
CVSS 3.0 Score 7.6 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 284
Summary
CVE-2024-10366 is an access control vulnerability affecting the danny-avila/librechat software version v0.7.5-rc2. This IDOR issue permits any authenticated user to delete attachments belonging to other users. The vulnerability arises due to the lack of verification for the attachment ID's ownership before processing the delete request, making it possible for unauthorized users to manipulate other users' data. This vulnerability poses a significant risk to data confidentiality and integrity within the affected system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.