MediumVulnerability
CVE-2026-54029: LibreChat: any authenticated user can delete messages via DELETE /api/messages
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54029
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
LibreChat versions prior to 0.8.4-rc1 let any authenticated user delete other users' messages through the DELETE /api/messages/:conversationId/:messageId endpoint. The validateMessageReq middleware checks only that the conversationId belongs to the requester, while the handler calls deleteMessages({ messageId }) with no user constraint, so an attacker can pair their own conversationId with a victim's messageId for permanent, irrecoverable deletion.
Mitigation
Fixed in 0.8.4-rc1.
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News