LibreChat version 0.8.1-rc2 contains a critical access control vulnerability that allows an authenticated user to compromise service-level authentication for the RAG API.

The application utilizes a shared JSON Web Token (JWT) secret for both user sessions and the Retrieval-Augmented Generation (RAG) API, which allows an authenticated user to bypass intended access controls. This configuration error enables unauthorized manipulation of the RAG API functionality.

The exploitation of this vulnerability permits unauthorized access to the RAG API, which could lead to the exposure of sensitive data or unauthorized processing within the LibreChat environment. With a CVSS score of 8.0, this high-severity flaw represents a significant risk to data integrity and service confidentiality. Successful exploitation could undermine the security posture of the application, potentially leading to unauthorized information disclosure or service disruption.

Immediate Action: Since a specific patch version is not currently identified, administrators should consult the vendor advisory and the official GitHub repository for updates or configuration guidance, such as rotating secrets if supported.

Proactive Monitoring: Review application access logs for unusual patterns or spikes in requests directed at the RAG API endpoints, particularly those originating from unauthorized or unexpected user sessions.

Compensating Controls: Implement strict network segmentation or Web Application Firewall (WAF) rules to restrict access to the RAG API endpoints to known and trusted internal sources until a vendor-supplied patch is applied.

Public Exploit Available: Unknown.

Given the high CVSS severity, organizations utilizing LibreChat version 0.8.1-rc2 must prioritize this issue. Administrators should monitor the official LibreChat GitHub repository for security releases and apply updates immediately upon availability to remediate the improper access control flaw.