CVE-2025-69221
📋 TL;DR
LibreChat version 0.8.1-rc2 has an improper access control vulnerability where authenticated users can read permissions of arbitrary agents by knowing their agent IDs. This allows attackers to view private agent permissions including individual user assignments. All LibreChat instances running the vulnerable version are affected.
💻 Affected Systems
- LibreChat
📦 What is this software?
Librechat by Librechat
Librechat by Librechat
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map all agent permissions across the system, potentially identifying sensitive agents and their authorized users for targeted attacks.
Likely Case
Information disclosure of agent permission structures, revealing which users have access to specific private agents.
If Mitigated
Minimal impact with proper network segmentation and monitoring, though information leakage still occurs.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of agent IDs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.2-rc2
Vendor Advisory: https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Update to version 0.8.2-rc2 via git pull or package update. 3. Restart LibreChat service. 4. Verify fix by testing agent permission queries.
🔧 Temporary Workarounds
Disable agent functionality
allTemporarily disable agent features if not required
Modify LibreChat configuration to disable agent endpoints
Implement API gateway filtering
allAdd WAF or reverse proxy rules to block unauthorized agent permission queries
Configure rules to validate user permissions before agent API requests
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to LibreChat instance
- Enable detailed logging of all agent permission queries and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if running version 0.8.1-rc2. Attempt to query agent permissions for agents you don't have access to.Check Version:
Check package.json or git tag for version informationVerify Fix Applied:
After updating to 0.8.2-rc2, verify that unauthorized agent permission queries return proper access denied errors.📡 Detection & Monitoring
Log Indicators:
- Multiple failed or successful agent permission queries from single user
- Agent permission queries for non-accessible agent IDs
Network Indicators:
- Unusual pattern of GET requests to /api/agents/*/permissions endpoints
SIEM Query:
source="librechat" AND (uri_path="/api/agents/*/permissions" AND response_code=200) | stats count by user, agent_id