CVE-2026-54029

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description An authenticated user can delete messages belonging to other users. The issue occurs at the 'DELETE /api/messages/:conversationId/:messageId' endpoint because the validateMessageReq middleware only verifies that the conversationId belongs to the requester. However, the subsequent handler calls the deleteMessages() function using only the messageId as a MongoDB filter, omitting a user constraint. An attacker can bypass validation by providing their own valid conversationId while specifying a victim's messageId, leading to permanent and irrecoverable message deletion.

Recommendations Update to version 0.8.4-rc1.