{"data":{"id":"83ae531f-4c36-4e78-8ef2-2f1db6149343","title":"CVE-2025-69220: LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for…","summary":"LibreChat version 0.8.1-rc2 does not enforce proper access control on file uploads to an agent's file context and file search. An authenticated attacker who knows an agent ID can upload files that change that agent's behavior, even without permissions for it.","solution":"This issue is fixed in version 0.8.2-rc2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69220","publishedAt":"2026-01-08T02:15:59.547Z","cveId":"CVE-2025-69220","cweIds":["CWE-284","CWE-862","CWE-862"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LibreChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LibreChat improper access control on agent file context uploads","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00335,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:48.121Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}