https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:01:07 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-13478 bdu:2026-13478 https://cve.radiocsirt.org/vuln/bdu:2026-13478 https://cve.radiocsirt.org/vuln/euvd-2026-330751 EUVD-2026-330751 https://cve.radiocsirt.org/vuln/euvd-2026-330751 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54029 <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user&#39;s messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim&#39;s messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.</p> <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user&#39;s messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim&#39;s messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54029