Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
danny-avila LibreChat — LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U N H N 6.5 .0018 8.1 —
AFFECTED
Product Versions Fixed
LibreChat < 0.8.4-rc1 – —
TIMELINE
Jun 11 Reserved by GitHub_M
Jun 25 EXPLOIT PUBLISHED — CVE-2026-54029 (danny-avila LibreChat). Public exploit reference added.
Jun 25 Published (CNA: GitHub_M)
Description
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim's messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 11, 2026 | Reserved | Reserved by GitHub_M |
| June 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54029 (danny-avila LibreChat). Public exploit reference added. |
| June 25, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| danny-avila | LibreChat | — | < 0.8.4-rc1 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54029 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.