CVE-2026-54029: LibreChat Unauthorized Message Deletion Vulnerability

Technical summary

The DELETE /api/messages/:conversationId/:messageId endpoint in LibreChat implements incomplete authorization logic. The validateMessageReq middleware correctly verifies that the requesting user owns the conversationId parameter, but the subsequent deleteMessages handler uses only the messageId as a MongoDB query filter—omitting any check that the message belongs to the requesting user. This allows an attacker to construct a request using (1) their own conversationId (which passes validation) and (2) a victim's messageId (harvested or guessed), resulting in deletion of that message regardless of ownership. The vulnerability stems from CWE-862 (Missing Authorization) and is classified as an Insecure Direct Object Reference (IDOR) variant. CVSS 3.1 score is 5.3 (MEDIUM), reflecting high integrity impact but no confidentiality or availability impact to the broader system.

Business impact

Message deletion is a data destruction attack with direct operational and compliance consequences. In shared LibreChat instances—common in organizations, research teams, and managed service deployments—an attacker can erase conversation history of other users without audit trail or recovery. This impacts data retention policies, regulatory compliance (e.g., communications preservation rules), incident investigation capabilities, and user trust. For enterprises using LibreChat as part of an AI collaboration platform, this creates unacceptable risk of message tampering and loss. The permanent nature of deletion (no soft-delete mechanism mentioned) elevates severity beyond typical UI-layer authorization flaws.

Affected systems

LibreChat versions prior to 0.8.4-rc1 are affected. This includes all 0.8.3, 0.8.2, 0.8.1, 0.8.0 releases and any earlier versions. Self-hosted LibreChat deployments and managed instances are in scope. The vulnerability requires authentication—an attacker must have valid user credentials on the target LibreChat instance. Exploitation is not limited by message age, conversation scope, or user role (all authenticated users are equally affected). Downstream consumers or integrations that embed LibreChat's API are potentially exposed if they do not impose additional authorization layers.

Exploitability

Exploitability is moderate but practical. The attack requires (1) valid authentication credentials (easily obtained if the instance is accessible or if credentials are compromised), (2) knowledge or enumeration of a target's messageId (potentially discoverable via UI inspection, API introspection, or by observing shared conversations), and (3) knowledge of the attacker's own conversationId (trivial—the attacker can create one). No special network position, timing, or user interaction is required. CVSS AC:H (high attack complexity) likely reflects the need to gather target messageIds; in real-world scenarios where users share conversations or message IDs are predictable, complexity may be lower. Once exploited, the impact is immediate and irreversible.

Remediation

Upgrade LibreChat to version 0.8.4-rc1 or later. The fix ensures that the deleteMessages handler validates both conversationId and messageId ownership against the requesting user before executing deletion. Organizations unable to upgrade immediately should restrict API access to trusted internal networks, enforce strict access controls on LibreChat credentials, and audit deleteMessages endpoint calls. Consider implementing read-only backups or message archival outside LibreChat to preserve critical conversation history. No workarounds are available at the application layer without code modification.

Patch guidance

Update to LibreChat 0.8.4-rc1 as the minimum fixed version. Release candidates are typically stable but less battle-tested than full releases; monitor release notes for progression to 0.8.4 stable or subsequent patches. Before deploying, test in a non-production environment to confirm compatibility with your configuration (AI provider integrations, custom plugins, reverse proxy settings). The fix is a logic change in the message deletion handler—no database schema changes or data migrations are expected. After patching, verify that users can still delete their own messages and that cross-user deletion attempts fail with a 403 Forbidden or equivalent error.

Detection guidance

Monitor DELETE /api/messages endpoint requests in access logs, focusing on patterns where conversationId and messageId ownership do not align. Look for (1) repeated 200 OK responses to message deletions in conversations not owned by the request source, (2) bulk deletion activity from low-privilege accounts, or (3) successful deletions preceded by API reconnaissance (OPTIONS or GET requests probing messageIds). Enable application-level logging if available to capture request parameters and user IDs. Correlate deletion patterns with user authentication logs to identify compromised accounts or insider threats. In immutable audit systems, log every deleteMessages attempt with full request parameters to enable forensic reconstruction.

Why prioritize this

Although CVSS is 5.3 (MEDIUM), this vulnerability warrants priority patching because (1) it enables permanent, non-repudiable data destruction by authenticated users, (2) affected systems likely store sensitive multi-user conversations (AI interactions, research, internal discussions), (3) no compensating controls are standard in LibreChat deployments, and (4) the fix is proven and low-risk. Organizations with compliance obligations around message retention or data integrity should treat this as high priority. For open-source instances or labs, priority can be lower; for production shared deployments, prioritize within your critical security patch window.

Risk score, explained

CVSS 3.1 5.3 reflects the specific constraint that authentication is required (PR:L), the attack is partially complex due to target enumeration (AC:H), and the system scope is unchanged (S:U). Integrity is high (I:H) because messages are permanently destroyed. Confidentiality and availability are not affected. SEC.co notes that CVSS may underweight the business and compliance impact of data destruction in collaborative settings; risk assessment should include your organization's data retention and incident response policies.

Frequently asked questions