MediumVulnerability
CVE-2025-69221: LibreChat agent permissions readable by authenticated users via agent ID
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-69221
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
LibreChat version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker who knows an agent ID can read that agent's permissions, including those individually assigned to other users, even without permissions on the agent.
Mitigation
Fixed in version 0.8.2-rc2.