LibreChat CVE-2025-66451

Exploitation requires sending a PATCH to /api/prompts/groups/:groupId on LibreChat version 0.8.0 or below, where patchPromptGroup forwards req.body to updatePromptGroup() without field filtering. The vendor fix tests grant PROMPTGROUP_OWNER permission before exercising the endpoint, indicating the realistic prerequisite is an authenticated user with write/owner access to the target prompt group. Limiting factors: affected versions only (fixed in 0.8.1); the attacker must be able to reach and patch a prompt group. Note the vendor vector lists PR:N (unauthenticated) and UI:P, which conflicts with the permission-gated test setup - confirm the true authentication requirement with the vendor.

This is a genuine but moderate-severity issue, not a top-tier priority. The signals are mostly consistent on the lower end: EPSS is 0.33% (25th percentile), indicating low predicted exploitation likelihood, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. Public exploit/advisory material exists (GHSA-vpqq-5qr4-655h), which raises the floor somewhat, but POC availability is a distinct signal from in-the-wild use. The core defect is a mass-assignment / improper input validation flaw (CWE-20): patchPromptGroup passed req.body directly to updatePromptGroup() without filtering, letting clients set sensitive fields (author, authorName, _id, productionId, createdAt) that the frontend never exposes. Impact is limited - modifying prompt-group metadata/ownership - consistent with the 5.3 (CVSS 4.0) 'medium' rating. A key conflict exists: the vendor CVSS vector states PR:N (unauthenticated) and UI:P, yet the vendor's own fix test suite grants PROMPTGROUP_OWNER permission before exercising the endpoint, implying an authenticated user with write access is actually required - verify the authentication precondition with the vendor before treating this as unauthenticated-reachable.

A user of a LibreChat instance (0.8.0 or below) who can edit a prompt group sends a crafted PATCH request to /api/prompts/groups/:groupId that includes server-controlled fields such as author, _id, or productionId. Because req.body is forwarded to updatePromptGroup() without field filtering, these values are written, letting the user reassign ownership or alter prompt-group state beyond what the UI permits. Public advisory and fix detail exist (GHSA-vpqq-5qr4-655h), so the technique is documented.