CVE-2025-69221

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69221", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T18:00:47.202Z", "datePublished": "2026-01-07T21:01:13.918Z", "dateUpdated": "2026-01-07T21:07:58.109Z"}, "containers": {"cna": {"title": "LibreChat has Insufficient Access Control for Agent Permission Queries", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7"}, {"name": "https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c", "tags": ["x_refsource_MISC"], "url": "https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c"}, {"name": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2", "tags": ["x_refsource_MISC"], "url": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2"}], "affected": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"version": "< 0.8.1-rc2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T21:01:13.918Z"}, "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when\nquerying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2."}], "source": {"advisory": "GHSA-5ccx-4r3h-9qc7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T21:07:28.828210Z", "id": "CVE-2025-69221", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T21:07:58.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69221", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T21:07:28.828210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T21:07:45.222Z"}}], "cna": {"title": "LibreChat has Insufficient Access Control for Agent Permission Queries", "source": {"advisory": "GHSA-5ccx-4r3h-9qc7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.1-rc2"}]}], "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7", "name": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c", "name": "https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2", "name": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when\nquerying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T21:01:13.918Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69221", "state": "PUBLISHED", "dateUpdated": "2026-01-07T21:07:58.109Z", "dateReserved": "2025-12-29T18:00:47.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T21:01:13.918Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LibreChat", "vendor": "danny-avila", "versions": [{"status": "affected", "version": "< 0.8.1-rc2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.8.1:-:*:*:*:*:*:*", "matchCriteriaId": "98BB9E92-2D0E-4975-A966-734F3858551B", "vulnerable": true}, {"criteria": "cpe:2.3:a:librechat:librechat:0.8.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "8DAB7F45-699A-4383-ABEA-D4374E58EE95", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when\nquerying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2."}, {"lang": "es", "value": "LibreChat es un clon de ChatGPT con caracter\u00edsticas adicionales. La versi\u00f3n 0.8.1-rc2 no aplica un control de acceso adecuado al consultar los permisos de los agentes. Un atacante autenticado puede leer los permisos de agentes arbitrarios, incluso si no tiene permisos para este agente. LibreChat permite la configuraci\u00f3n de agentes que tienen un conjunto predefinido de instrucciones y contexto. Los agentes privados no son visibles para otros usuarios. Sin embargo, si un atacante conoce el ID del agente, puede leer los permisos del agente, incluidos los permisos asignados individualmente a otros usuarios. Este problema se corrige en la versi\u00f3n 0.8.2-rc2."}], "id": "CVE-2025-69221", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69221", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T21:07:28.828210Z", "version": "2.0.3"}}]}, "published": "2026-01-07T21:15:59.760", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/danny-avila/LibreChat/commit/06ba025bd95574c815ac6968454be7d3b024391c"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5ccx-4r3h-9qc7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2026-01-08T09:47:54.103144+00:00", "updated": "2026-01-08T09:47:54.103193+00:00", "vendors": ["librechat", "librechat$PRODUCT$librechat"]}