Executive brief
LibreChat, a popular open-source interface for AI models like ChatGPT, contains a security flaw that allows any logged-in user to delete messages belonging to other users. By exploiting this issue, an attacker can permanently and irrecoverably remove chat history across the platform. This can lead to significant data loss and disruption for users who rely on the service to store their AI interactions.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the message deletion logic of LibreChat. The `validateMessageReq` middleware only verifies that the `conversationId` provided in the URL belongs to the authenticated user, but it fails to validate the `messageId`. The underlying `deleteMessages` handler then executes a MongoDB `deleteMany` operation using only the `messageId` as a filter, without enforcing a user-ownership constraint. An attacker can bypass authorization by providing a `conversationId` they own alongside a target `messageId` belonging to another user. This issue was an incomplete fix for a previous vulnerability (CVE-2024-41703) and is resolved in version 0.8.4-rc1.
Affected products
- danny-avila LibreChat < 0.8.4-rc1
Timeline
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD