---
id: CVE-2025-7106
title: >-
  danny-avila/librechat is affected by an authorization bypass vulnerability due
  to improper access control checks
summary: >-
  danny-avila/librechat is affected by an authorization bypass vulnerability due
  to improper access control checks. The `checkAccess` function in
  `api/server/middleware/roles/access.js` uses `permissions.some()` to validate
  permissions, wh…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-284
  - CWE-639
vendor: librechat
product: librechat
affected:
  - librechat < 0.7.9
patched:
  - librechat 0.7.9
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-7106'
references:
  - url: >-
      https://github.com/danny-avila/librechat/commit/91a2df47599c09d80886bfc28e0ccf1debd42110
    label: security@huntr.dev
  - url: 'https://huntr.com/bounties/7de2765b-d1fe-4495-9144-220070857c48'
    label: security@huntr.dev
tags:
  - nvd
epss: 0.00278
epssPercentile: 0.18636
ingestedAt: '2026-10-12T14:50:33.980Z'
---

## Overview

danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, as the check for `['USE', 'CREATE']` passes with just `USE: true`. This vulnerability affects other permission checks as well, such as `PROMPTS`. The issue is present in all versions prior to the fix.

## Affected

- `librechat < 0.7.9`

## Remediation

Upgrade past the affected range:

- `librechat 0.7.9`