{"id":"CVE-2025-7106","title":"danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks","summary":"danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, wh…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-284","CWE-639"],"vendor":"librechat","product":"librechat","affected":["librechat < 0.7.9"],"patched":["librechat 0.7.9"],"published":"2025-09-23","updated":"2026-10-11","sourceUpdated":"2026-10-11T20:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-7106","references":[{"url":"https://github.com/danny-avila/librechat/commit/91a2df47599c09d80886bfc28e0ccf1debd42110","label":"security@huntr.dev"},{"url":"https://huntr.com/bounties/7de2765b-d1fe-4495-9144-220070857c48","label":"security@huntr.dev"}],"tags":["nvd"],"epss":0.00278,"epssPercentile":0.18636,"ingestedAt":"2026-10-12T14:50:33.980Z","slug":"CVE-2025-7106","body":"## Overview\n\ndanny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, as the check for `['USE', 'CREATE']` passes with just `USE: true`. This vulnerability affects other permission checks as well, such as `PROMPTS`. The issue is present in all versions prior to the fix.\n\n## Affected\n\n- `librechat < 0.7.9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `librechat 0.7.9`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}