A critical authorization vulnerability in LibreChat versions 0.0.6 through 0.7.7-rc1 allows unauthenticated attackers to access sensitive user chat data from the underlying Meilisearch engine.

This is an improper authorization vulnerability (CWE-285) involving the /api/search/test endpoint. The endpoint fails to perform access control checks, enabling unauthenticated remote attackers to query and read chat logs directly from the Meilisearch database.

The ability for an unauthenticated party to retrieve private chat history poses a severe risk of data breach and intellectual property loss. Given the CVSS score of 7.5, this vulnerability represents a high risk to confidentiality, as it bypasses all application-level authentication mechanisms to expose potentially sensitive user information.

Immediate Action: Upgrade LibreChat to version 0.7.7 or later to implement proper authorization checks on the affected testing endpoint.

Proactive Monitoring: Review application access logs for unusual traffic patterns directed at the /api/search/test path and monitor Meilisearch query logs for unauthorized search activity.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or restrict access to the /api/search/test endpoint until the patch can be deployed.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the privacy of user interactions within the LibreChat platform. Administrators should prioritize the update to version 0.7.7 immediately to close the exposed testing endpoint and prevent unauthorized data exfiltration.