CVE-2026-44654: LibreChat Privilege Escalation Flaw

CVE-2026-44654 Overview

CVE-2026-44654 is an authorization flaw in LibreChat, an open-source ChatGPT alternative that supports multiple AI providers. The vulnerability affects all versions up to and including 0.8.3. A user granted editor access to a shared agent can issue DELETE /api/files requests to remove file records owned by another user. The deletion is global rather than scoped to the shared agent, which silently breaks the owner's private agents that reference the same file_id. The flaw is tracked as an Incorrect Authorization weakness [CWE-863]. LibreChat 0.8.4 contains the fix.

Critical Impact
A shared-agent editor can destroy files used by the owner's other private agents, leaving stale file_id references and breaking unrelated agents the attacker cannot otherwise access.

Affected Products

LibreChat versions 0.8.3 and earlier
LibreChat shared-agent editor permission model
LibreChat /api/files deletion endpoint

Discovery Timeline

2026-06-02 - CVE-2026-44654 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-44654

Vulnerability Analysis

LibreChat supports collaborative agents where owners can grant editor access to other users. Each agent can attach files identified by a file_id. Owners often reuse the same file_id across multiple private and shared agents to avoid duplicating uploads.

The DELETE /api/files endpoint accepts a list of file_id values from any caller who has edit rights on an agent referencing the file. The handler removes the file record from the global file store rather than detaching it from the specific agent. As a result, an editor on one shared agent can permanently delete files referenced by the owner's other agents, which the editor has no privilege to view or modify.

This represents a cross-agent integrity violation. Editing access to one agent should not propagate destructive operations to resources used by other agents owned by the same user.

Root Cause

The root cause is missing object-level authorization on file deletion. The endpoint validates that the caller has editor rights on an agent that references the file, but does not verify that the caller has ownership over the file itself or that the file is unused by other agents. The deletion logic operates on the global file table instead of the agent-to-file association.

Attack Vector

An authenticated user with editor permissions on any shared agent identifies a file_id attached to that agent. The attacker sends an authenticated DELETE /api/files request including that file_id. The backend removes the file record globally. Other agents owned by the file owner retain a stale file_id reference that no longer resolves, causing silent functional failure across the owner's private workspace.

No public proof-of-concept code is published for this issue. Technical details are available in the LibreChat GitHub Security Advisory GHSA-f8jg-v856-mf6q.

Detection Methods for CVE-2026-44654

Indicators of Compromise

Unexplained DELETE /api/files requests from non-owner accounts in LibreChat application logs
Private agents returning resolution errors for previously valid file_id references
File records disappearing from storage shortly after shared-agent editor activity
User reports of broken file attachments on agents not shared with other users

Detection Strategies

Audit application logs for DELETE /api/files calls where the requesting user is not the file owner
Correlate file deletion events with the file's reference count across all agents prior to deletion
Flag deletions of files referenced by more than one agent or by agents not shared with the caller
Compare current file_id references in agent definitions against the file store to find orphaned references

Monitoring Recommendations

Forward LibreChat API access logs to a centralized logging platform for correlation and retention
Alert on file deletion bursts originating from a single editor account
Track agent integrity by periodically validating that all file_id references resolve to existing files
Monitor changes to agent share permissions and subsequent destructive API actions by new editors

How to Mitigate CVE-2026-44654

Immediate Actions Required

Upgrade LibreChat to version 0.8.4 or later, which contains the authorization fix
Review current shared-agent editor grants and revoke access for untrusted accounts
Audit recent DELETE /api/files activity and restore any improperly deleted files from backup
Notify agent owners to validate that file attachments in their private agents still resolve

Patch Information

The maintainers released the fix in LibreChat 0.8.4. The patch enforces ownership and reference checks on the DELETE /api/files endpoint so that editors of a shared agent cannot remove file records used elsewhere. Full details are documented in the LibreChat GitHub Security Advisory GHSA-f8jg-v856-mf6q.

Workarounds

Restrict shared-agent editor permissions to fully trusted users until the upgrade is applied
Avoid reusing the same file_id across private and shared agents on vulnerable versions
Maintain offline backups of uploaded files so deleted records can be restored
Place LibreChat behind a reverse proxy that logs and rate-limits DELETE /api/files requests

bash

# Upgrade LibreChat to the patched release
git fetch --tags
git checkout v0.8.4
npm install
npm run build
# Restart the LibreChat service after the upgrade