LibreChat EUVD-2026-39462

Exploitation requires a valid authenticated session on the LibreChat instance (PR:L per CVSS vector - unauthenticated exploitation is not possible). The attacker must know or enumerate the target agent's ID, which may be discoverable through normal application use or API enumeration. The vulnerability is specific to the POST /api/files/images endpoint and only bypasses authorization on agent tool_resources writes; it does not affect confidentiality. Exploitation is limited to multi-user deployments where distinct users own separate agents - in single-user instances the impact is self-directed. No non-default configuration is required; the vulnerable endpoint is available in any standard LibreChat deployment prior to 0.8.4-rc1.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, score 6.5) accurately characterizes the attack: network-accessible with low complexity, requiring only an authenticated low-privilege account, no user interaction, impacting only integrity. No EPSS data was provided in the input; the CVE is not listed in CISA KEV and no public POC has been confirmed. Real-world risk is elevated in multi-tenant or shared LibreChat deployments where multiple users operate distinct agents - an authenticated attacker can corrupt or manipulate another user's agent context or code execution environment, potentially enabling downstream prompt injection or supply-chain-style manipulation of AI agent behavior. In single-user or tightly access-controlled deployments, practical risk is low. The absence of confidentiality impact limits blast radius but integrity manipulation of AI tool_resources can have non-obvious downstream consequences.

An authenticated LibreChat user with a standard account enumerates or guesses the agent ID of another user's agent, then issues a POST request to /api/files/images referencing that agent's tool_resources identifier. Because no authorization check validates ownership or EDIT rights on the image endpoint, the upload succeeds, injecting attacker-controlled content into the victim agent's context or execute_code environment. No public POC has been confirmed, but the attack requires only a valid session token and knowledge of a target agent ID.