CVE-2024-11167

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-111683.7The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFut CVE-2024-111697.5An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an ex CVE-2024-11179.8A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of t CVE-2024-111708.8A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the mul CVE-2024-111717.5In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware fo CVE-2024-111727.5A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a cr CVE-2024-111736.5An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial CVE-2024-111754.8A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /ad CVE-2024-111765.3Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information vi CVE-2024-111788.1The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the p CVE-2024-111796.5The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' par CVE-2024-11188.8The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subsc