CVE-2026-54027: LibreChat Authorization Bypass in Image Upload Endpoint

Technical summary

CVE-2026-54027 is an authorization vulnerability (CWE-862) in LibreChat versions prior to 0.8.4-rc1. The POST /api/files/images endpoint fails to validate ownership or EDIT permissions before allowing file uploads to an agent's tool_resources (including context and code execution contexts). While a previous patch added permission checks to POST /api/files, the image upload route remained unprotected. An attacker can leverage this inconsistent security implementation to bypass authorization entirely by targeting the image endpoint instead of the file endpoint. The vulnerability requires authentication but no additional user interaction.

Business impact

If LibreChat is used for collaborative AI workflows or agent-based automation, this vulnerability enables lateral privilege escalation within the platform. An attacker could corrupt or poison an agent's knowledge base, inject malicious code into execution contexts, or tamper with shared resources, leading to unreliable or compromised AI outputs. For organizations using LibreChat with sensitive workloads, this creates a risk of data integrity violations and potential downstream impact on automated decision-making or code generation processes.

Affected systems

LibreChat versions prior to 0.8.4-rc1 are affected. The vulnerability is resolved in 0.8.4-rc1 and later releases. Any deployment running an earlier version with multi-user or agent-sharing functionality is at risk.

Exploitability

Exploitability is straightforward. The attack requires only valid authentication (Low privilege, Network accessible endpoint, no user interaction). An attacker with any LibreChat account can craft a simple POST request to /api/files/images targeting another user's agent, uploading arbitrary files. No special tools or knowledge of internal systems is required. The CVSS score of 6.5 (MEDIUM) reflects the authentication requirement but acknowledges the ease of execution and the integrity impact.

Remediation

Upgrade LibreChat to version 0.8.4-rc1 or later. The fix applies the same permission-checking logic to the image upload endpoint as was previously applied to the standard file upload route, ensuring consistent authorization validation across both code paths.

Patch guidance

Apply the upgrade to 0.8.4-rc1 or later as soon as practical. Because the vulnerability requires authentication and does not enable remote code execution or data exfiltration, patching can be scheduled within a standard maintenance window—however, environments with multi-user or agent-sharing deployments should prioritize this update to prevent lateral tampering. Test the upgrade in a staging environment to ensure compatibility with any custom agent configurations.

Detection guidance

Monitor access logs for repeated POST requests to /api/files/images from a single user account, especially targeting multiple different agent IDs or tool_resources. Look for file uploads followed by agents exhibiting unexpected behavior or containing suspicious content in their resource storage. Review file upload history for each agent to identify unauthorized uploads by users other than the agent owner. If your LibreChat instance has audit logging, examine logs for any calls to /api/files/images that do not originate from the agent owner or a user with explicit EDIT permissions.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt attention in multi-user or collaborative LibreChat environments because it enables direct tampering with shared AI resources. The ease of exploitation (a simple authenticated request) and the integrity risk to agent behavior make this a meaningful priority for organizations relying on LibreChat for shared or production workflows. Environments with single-user or segregated agent deployments face lower practical risk.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible, authenticated attack with low complexity and high integrity impact but no confidentiality or availability impact. The authentication requirement prevents unauthenticated exploitation; the straightforward logic and lack of additional controls elevate exploitability within the authenticated user base. The integrity impact is significant because poisoned agents can affect downstream business logic or user trust, but the lack of direct data loss or service disruption limits the score from higher severity tiers.

Frequently asked questions