{"api_version":"1","generated_at":"2026-10-27T13:59:04+00:00","cve":"CVE-2025-69220","urls":{"html":"https://cve.report/CVE-2025-69220","api":"https://cve.report/api/cve/CVE-2025-69220.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-69220","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-69220"},"summary":{"title":"LibreChat has Insufficient Access Control for Agent Files","description":"LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-01-07 21:15:59","updated_at":"2026-10-07 09:10:00"},"problem_types":["CWE-284","CWE-862","CWE-862 CWE-862: Missing Authorization","CWE-284 CWE-284: Improper Access Control"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","version":"3.1"}}],"references":[{"url":"https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html","name":"https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html","refsource":"security-advisories@github.com","tags":["Technical Description"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237","name":"https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237","refsource":"security-advisories@github.com","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59","name":"https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59","refsource":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://owasp.org/Top10/A01_2021-Broken_Access_Control","name":"https://owasp.org/Top10/A01_2021-Broken_Access_Control","refsource":"security-advisories@github.com","tags":["Not Applicable"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf","name":"https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf","refsource":"security-advisories@github.com","tags":["Technical Description"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2","name":"https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2","refsource":"security-advisories@github.com","tags":["Release Notes"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cwe.mitre.org/data/definitions/862.html","name":"https://cwe.mitre.org/data/definitions/862.html","refsource":"security-advisories@github.com","tags":["Not Applicable"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cwe.mitre.org/data/definitions/284.html","name":"https://cwe.mitre.org/data/definitions/284.html","refsource":"security-advisories@github.com","tags":["Not Applicable"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69220","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69220","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"danny-avila","product":"LibreChat","version":"affected >= 0.8.1-rc2, < 0.8.2-rc2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"69220","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"librechat","cpe5":"librechat","cpe6":"0.8.1","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"69220","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"librechat","cpe5":"librechat","cpe6":"0.8.1","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"69220","cve":"CVE-2025-69220","epss":"0.003350000","percentile":"0.246150000","score_date":"2026-10-04","updated_at":"2026-10-05 00:09:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-69220","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-07T21:33:29.380614Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-01-07T21:33:56.352Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"LibreChat","vendor":"danny-avila","versions":[{"status":"affected","version":">= 0.8.1-rc2, < 0.8.2-rc2"}]}],"descriptions":[{"lang":"en","value":"LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-01-07T20:52:04.912Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59","tags":["x_refsource_CONFIRM"],"url":"https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59"},{"name":"https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237","tags":["x_refsource_MISC"],"url":"https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237"},{"name":"https://cwe.mitre.org/data/definitions/284.html","tags":["x_refsource_MISC"],"url":"https://cwe.mitre.org/data/definitions/284.html"},{"name":"https://cwe.mitre.org/data/definitions/862.html","tags":["x_refsource_MISC"],"url":"https://cwe.mitre.org/data/definitions/862.html"},{"name":"https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2","tags":["x_refsource_MISC"],"url":"https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2"},{"name":"https://owasp.org/Top10/A01_2021-Broken_Access_Control","tags":["x_refsource_MISC"],"url":"https://owasp.org/Top10/A01_2021-Broken_Access_Control"},{"name":"https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html","tags":["x_refsource_MISC"],"url":"https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html"},{"name":"https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf","tags":["x_refsource_MISC"],"url":"https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf"}],"source":{"advisory":"GHSA-xcmf-rpmh-hg59","discovery":"UNKNOWN"},"title":"LibreChat has Insufficient Access Control for Agent Files"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2025-69220","datePublished":"2026-01-07T20:49:00.454Z","dateReserved":"2025-12-29T18:00:37.183Z","dateUpdated":"2026-01-07T21:33:56.352Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-01-07 21:15:59","lastModifiedDate":"2026-10-07 09:10:00","problem_types":["CWE-284","CWE-862","CWE-862 CWE-862: Missing Authorization","CWE-284 CWE-284: Improper Access Control"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-07T21:33:29.380614Z","id":"CVE-2025-69220","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:librechat:librechat:0.8.1:-:*:*:*:*:*:*","matchCriteriaId":"98BB9E92-2D0E-4975-A966-734F3858551B"},{"vulnerable":true,"criteria":"cpe:2.3:a:librechat:librechat:0.8.1:rc1:*:*:*:*:*:*","matchCriteriaId":"8DAB7F45-699A-4383-ABEA-D4374E58EE95"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"69220","Ordinal":"1","Title":"LibreChat has Insufficient Access Control for Agent Files","CVE":"CVE-2025-69220","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"69220","Ordinal":"1","NoteData":"LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.","Type":"Description","Title":"LibreChat has Insufficient Access Control for Agent Files"}]}}}