CVE-2026-54027

{
  "id": "CVE-2026-54027",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T17:16:40.397",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1."
    },
    {
      "lang": "es",
      "value": "LibreChat es un clon mejorado de ChatGPT que soporta múltiples proveedores de IA. Antes de 0.8.4-rc1, el endpoint POST /api/files/images permite a cualquier usuario autenticado subir archivos a los tool_resources de cualquier agente (por ejemplo, context, execute_code) sin verificar la propiedad o el permiso de EDICIÓN en el agente objetivo. Se añadió una verificación de permisos a la ruta POST /api/files en un parche anterior, pero la ruta de subida de imágenes nunca se actualizó con la misma verificación. Un atacante puede simplemente usar el endpoint de imágenes en lugar del endpoint de archivos para eludir la autorización por completo. Esta vulnerabilidad está corregida en 0.8.4-rc1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "danny-avila",
          "product": "LibreChat",
          "versions": [
            {
              "version": "< 0.8.4-rc1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T15:20:33.829289Z",
          "id": "CVE-2026-54027",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "0.8.3",
              "matchCriteriaId": "77B80F25-E7C2-442E-98E3-F4462C40C74F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}