LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats
Priority MEDIUM 57CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:streamId` does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations. Version 0.8.2 patches the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed LibreChat (danny-avila): 0.8.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| danny-avila | LibreChat | 0.8.2-rc2 to before 0.8.2 | 0.8.2 | Patch available | CNA |
- LibreChat Vendordanny-avila Affected 0.8.2-rc2 to before 0.8.2 Fixed in 0.8.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:* | 0.8.2 rc2 | Vulnerable | danny-avila |
| cpe:2.3:a:librechat:librechat:0.8.2:rc3:*:*:*:*:*:* | 0.8.2 rc3 | Vulnerable | danny-avila |
- cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:* Versions 0.8.2 rc2 Vulnerable ·danny-avila
- cpe:2.3:a:librechat:librechat:0.8.2:rc3:*:*:*:*:*:* Versions 0.8.2 rc3 Vulnerable ·danny-avila
Remediation
- Fix · CNA LibreChat (danny-avila) Fixed in 0.8.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-31950
More danny-avila Librechat vulnerabilities
- TI-2026-25134 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection CVSS 3.1CRITICAL 9.6
- TI-2026-17862 LibreChat MCP Stdio Remote Command Execution CVSS 3.1CRITICAL 9.9
- TI-2026-38976 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow CVSS 3.1CRITICAL 9.3
- TI-2024-27763 LibreChat through 0.7.4-rc1 has incorrect access control for message updates. CVSS 3.1CRITICAL 9.8
- TI-2024-10347 Path Traversal in danny-avila/librechat CVSS 3.0HIGH 8.8
- TI-2026-25682 In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. CVSS 3.1CRITICAL 9.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences