CVE-2025-54868 - CVE House
Back to Database
Status published High CVE-2025-54868

LibreChat exposes arbitrary chats through Meilisearch engine

Vulnerability Description

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54868

Credits & Attribution

No credits recorded in the NVD database.

References

More from danny-avila

View All →
CVE-2025-8850
Insecure API Design in danny-avila/librechat
Low 3.1
CVE-2025-8849
Denial of Service in danny-avila/librechat
Medium 5.4
CVE-2025-8848
HTML Injection in Accept-Language Header in danny-avila/librechat
Medium 4.8
CVE-2025-7106
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
Medium 5.3
CVE-2025-7105
Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
Medium 5.7

Affected Vendor

danny-avila

View all reports →

Affected Software

LibreChat
Vulnerable Versions:
>= 0.0.6, < 0.7.7

Timeline

Official Publish: August 5th, 2025
Last Modified: August 5th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion