CVE-2024-10359 - CVE House
Back to Database
Status published Medium CVE-2024-10359

Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat

Vulnerability Description

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10359

Credits & Attribution

No credits recorded in the NVD database.

References

More from danny-avila

View All →
CVE-2025-8850
Insecure API Design in danny-avila/librechat
Low 3.1
CVE-2025-8849
Denial of Service in danny-avila/librechat
Medium 5.4
CVE-2025-8848
HTML Injection in Accept-Language Header in danny-avila/librechat
Medium 4.8
CVE-2025-7106
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
Medium 5.3
CVE-2025-7105
Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
Medium 5.7

Affected Vendor

danny-avila

View all reports →

Affected Software

danny-avila/librechat
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-915

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.