What is the CVSS score of CVE-2026-54029?

CVE-2026-54029 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-54029?

Yes, a patch is available for CVE-2026-54029. Update the affected software to the latest version immediately.

LibreChat CVE-2026-54029

EUVD-2026-39461 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 GitHub_M

Authentication Bypass Librechat Danny Avila

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible API requires authenticated low-privilege user and knowledge of a non-guessable MongoDB ObjectID (AC:H); deletion causes high integrity loss with no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 15:37 NVD

5.3 (MEDIUM) 6.5 (MEDIUM)

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:20 vuln.today

DescriptionNVD

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter - without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim's messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.

AnalysisAI

Broken object-level authorization in LibreChat's message deletion endpoint allows any authenticated user to permanently delete messages belonging to other users. Affected are all LibreChat deployments prior to 0.8.4-rc1. By supplying their own valid conversationId for middleware validation while targeting a victim's messageId in the underlying MongoDB query, an attacker bypasses the per-user authorization check and irreversibly removes arbitrary messages. No public exploit or CISA KEV listing exists at time of analysis, but the flaw is straightforward to exploit once a valid messageId is obtained.

Technical ContextAI

LibreChat (CPE: cpe:2.3:a:danny-avila:librechat:*:*:*:*:*:*:*:*) is a Node.js-based self-hosted AI chat frontend supporting multiple LLM providers. The vulnerability resides in the DELETE /api/messages/:conversationId/:messageId REST endpoint. The validateMessageReq middleware correctly checks that the conversationId is owned by the requesting user, but the handler subsequently calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter, omitting a userId constraint. This is a textbook CWE-862 (Missing Authorization) pattern: authorization is validated on one attribute (conversationId) while the privileged operation is executed against a different, unchecked attribute (messageId). Because MongoDB ObjectIDs encode a timestamp and machine identifier rather than sequential integers, guessing them is non-trivial, which maps to the AC:H metric in the provided CVSS vector.

RemediationAI

Upgrade to LibreChat 0.8.4-rc1 or later, which resolves the issue by adding a user ownership constraint to the deleteMessages MongoDB query so that the filter includes both messageId and the authenticated userId. The vendor advisory is at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-8892-xj8q-59xc. If upgrading immediately is not feasible, operators can mitigate by restricting the DELETE /api/messages/:conversationId/:messageId endpoint at the reverse proxy or API gateway layer to prevent cross-user requests - though this may break legitimate single-user deletion workflows and requires careful testing. Alternatively, temporarily disabling message deletion functionality at the application level eliminates the attack surface without affecting read access. Both workarounds introduce usability trade-offs and should be treated as temporary measures until the patch is applied.