CVE-2025-7106: LibreChat Authorization Bypass Vulnerability

CVE-2025-7106 Overview

CVE-2025-7106 is an authorization bypass vulnerability in danny-avila/librechat, an open-source AI chat platform. The flaw resides in the checkAccess function within api/server/middleware/roles/access.js, which validates user permissions using the JavaScript permissions.some() method. This logic grants access when only one of several required permissions is present, rather than requiring all of them. Users assigned the USER role can create agents even when their CREATE permission is set to false, because the check for ['USE', 'CREATE'] passes as long as USE: true. The defect also affects PROMPTS and other permission groups. All LibreChat versions prior to commit 91a2df4 are affected.

Critical Impact
Low-privilege users can bypass role-based access controls to perform actions such as creating agents and prompts they were explicitly denied.

Affected Products

LibreChat (danny-avila/librechat) all versions prior to commit 91a2df47599c09d80886bfc28e0ccf1debd42110
Deployments using role-based permission checks for AGENTS, PROMPTS, and related resources
Self-hosted LibreChat instances relying on the USER role for restricted operations

Discovery Timeline

2025-09-23 - CVE-2025-7106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7106

Vulnerability Analysis

The vulnerability is a broken access control defect classified under [CWE-284] and [CWE-639]. LibreChat exposes granular permission types such as AGENTS, PROMPTS, and their sub-actions (USE, CREATE, SHARE). Server-side middleware is expected to confirm that a caller holds every permission required for a given action. Instead, the middleware uses Array.prototype.some(), which returns true if any single element in the required list matches. An attacker with a partial permission set therefore satisfies the check for actions that require multiple permissions. The bug is a network-reachable authorization flaw exploitable by any authenticated USER account without user interaction.

Root Cause

The root cause is incorrect logical quantification in checkAccess. The middleware iterates the required permission list using some(), which implements existential logic ("at least one"), when the semantics of the check demand universal logic ("all must be true"). Because USE is typically granted by default to the USER role, any compound check that includes USE alongside a restricted action such as CREATE will always pass.

Attack Vector

An authenticated user sends a request to a protected endpoint (for example, agent creation or prompt creation). The middleware evaluates the required permission array with some(), finds that the user holds at least one of the listed permissions, and returns success. The user then invokes functionality the administrator explicitly restricted through the role configuration.

typescript

// Security patch in packages/api/src/middleware/access.ts
// refactor: Change Permissions Check from `some` to `every` for Stricter Access
const role = await getRoleByName(user.role);
if (role && role.permissions && role.permissions[permissionType]) {
-  const hasAnyPermission = permissions.some((permission) => {
+  const hasAnyPermission = permissions.every((permission) => {
    if (
      role.permissions?.[permissionType as keyof typeof role.permissions]?.[
        permission as keyof (typeof role.permissions)[typeof permissionType]

Source: GitHub commit 91a2df4

Detection Methods for CVE-2025-7106

Indicators of Compromise

Successful HTTP requests to agent-creation or prompt-creation endpoints originating from accounts whose role configuration sets CREATE: false
Application audit records showing new agents or prompts owned by non-privileged users
Unexpected growth in agent or prompt inventories that does not correspond to administrator-approved role changes

Detection Strategies

Review LibreChat MongoDB collections for agents and prompts created by users whose assigned role lacks the corresponding CREATE permission
Correlate access logs against the role configuration file to identify authorization decisions that contradict declared permissions
Add server-side logging inside checkAccess to record the evaluated permission array, the caller role, and the resulting decision

Monitoring Recommendations

Alert on any object creation events performed by accounts holding only the default USER role
Track version metadata of the LibreChat deployment and flag instances running below the patched commit 91a2df4
Monitor administrative changes to role documents to detect attempts at obscuring unauthorized activity

How to Mitigate CVE-2025-7106

Immediate Actions Required

Upgrade LibreChat to a build that includes commit 91a2df47599c09d80886bfc28e0ccf1debd42110 or later
Audit existing agents, prompts, and other permission-gated objects for entries created by users lacking the required CREATE permission and remove unauthorized artifacts
Review and tighten role definitions, ensuring USER accounts do not carry unintended permissions

Patch Information

The fix replaces permissions.some() with permissions.every() in the checkAccess middleware, enforcing that all listed permissions must be present before access is granted. See the upstream commit and the Huntr disclosure for details.

Workarounds

If immediate upgrade is not feasible, apply the one-line change from some to every in api/server/middleware/roles/access.js and rebuild the container image
Restrict access to agent and prompt creation endpoints at a reverse proxy layer until the patch is deployed
Temporarily disable the USER role for new registrations and require administrator approval for account provisioning

bash

# Verify the deployed LibreChat commit matches the patched revision
cd /opt/librechat
git log --oneline | grep 91a2df4 || echo "Patch not applied - upgrade required"

# Search MongoDB for agents created by non-privileged users
mongosh librechat --eval 'db.agents.find({ author: { $in: db.users.find({ role: "USER" }, { _id: 1 }).toArray().map(u => u._id) } })'