CVE-2025-69221: 
NixOS vulnerability analysis and mitigation

CVE-2025-69221 is an Improper Access Control vulnerability in LibreChat that allows authenticated attackers to read the permissions of arbitrary agents without authorization. Discovered by Lisa Gnedt and Michael Koppmann of SBA Research (identifier SBA-ADV-20251203-02), it affects LibreChat version 0.8.1-rc2 and was publicly disclosed on January 7, 2026. The vulnerability was fixed in version 0.8.2-rc2, released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862 / CWE-284) on the GET /api/permissions/:resourceType/:resourceId endpoint. While the corresponding PUT endpoint correctly enforced a SHARE permission check via middleware, the GET endpoint had no such control, allowing any authenticated user to retrieve full permission details for any agent, prompt group, or MCP server by supplying its ID. The MongoDB ObjectId format used for agent IDs (4-byte timestamp + 5-byte process-specific random value + 3-byte counter) is partially predictable, making brute-force enumeration of valid agent IDs feasible when an attacker already knows some IDs. The fix added a checkResourcePermissionAccess middleware factory that enforces PermissionBits.SHARE before allowing access to the GET endpoint (GitHub Advisory, Patch Commit).

An authenticated attacker who knows or can enumerate an agent ID can retrieve the full permission structure of any agent, including the names, email addresses, user IDs, avatar URLs, and assigned access roles (e.g., agent_owner) of all users with permissions on that agent, as well as the agent's public/private sharing status. This exposes sensitive organizational information such as user identity data, authorization policies, and agent usage patterns. There is no integrity or availability impact; the vulnerability is limited to confidentiality of agent permission metadata (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating a simple authenticated HTTP GET request to /api/permissions/agent/{agent_id} that returns full permission data. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.02% (0.000200), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Authentication: Log in to the target LibreChat instance with any valid user account (the user role is sufficient).
2. Agent ID Discovery: Obtain at least one known agent ID (e.g., from a shared agent link, API response, or prior interaction). Because agent IDs are MongoDB ObjectIds, brute-force enumeration is feasible by iterating over the timestamp, process ID, and counter components of IDs near known valid ones.
3. Craft the Request: Send an authenticated HTTP GET request to the permissions endpoint:

   GET /api/permissions/agent/{agent_id} HTTP/1.1
   Host: librechat.example.com
   Authorization: Bearer <your_jwt_token>

4. Retrieve Permission Data: The server responds with a JSON object containing the resourceId, principals array (including user names, emails, IDs, avatars, and access roles), and the public flag — even for private agents the attacker has no access to.
5. Enumerate Further: Repeat step 3 with additional agent IDs to map out agent ownership and access patterns across the organization (GitHub Advisory).

• Network: Repeated or scripted GET /api/permissions/agent/<id> requests from a single authenticated user, especially targeting agent IDs not associated with that user's own agents; sequential or near-sequential MongoDB ObjectId values in the request path suggesting enumeration.
• Logs: Web server/application access logs showing a high volume of GET /api/permissions/agent/* requests returning HTTP 200 from a single user account or IP address; requests to agent IDs that do not belong to the requesting user.
• Behavioral: A single user account querying permissions for a large number of distinct agent IDs in a short time window, particularly IDs belonging to other users' private agents (GitHub Advisory).

Upgrade LibreChat to version 0.8.2-rc2 or later, which adds the checkResourcePermissionAccess middleware to the GET /api/permissions/:resourceType/:resourceId endpoint, enforcing SHARE permission before returning any data (Patch Commit, Release Notes). For organizations unable to upgrade immediately, restrict LibreChat access to trusted and known users only, limit network exposure of the application (e.g., place behind a VPN or internal network), and monitor access logs for anomalous permission query patterns. Auditing existing agent permissions to identify any unauthorized exposure is also recommended (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by researchers Lisa Gnedt and Michael Koppmann at SBA Research, who published a detailed security advisory on January 8, 2026. SBA Research noted that the discovery was supported by CYSSDE and the European Union. The LibreChat maintainer responded promptly, confirming the vulnerability on December 29, 2025, and releasing a fix on January 7, 2026 — the same day as public disclosure (SBA Research Advisory, GitHub Advisory).