According to VRChat EULA 7.4.a (https://www.vrchat.com/legal):
> you are the creator and owner of the User Content, or have the necessary licenses, rights, consents, and permissions
So, VRChat user can publish a world that is not created by himself (if he has the licenses). But in current UI of world selection in game quick menu, it will be noted as "Authored By:". I think this expression ("Authored By:") is not suitable in this case if we want to treat third-party rights carefully.
Another type of User Content, avatars have more serious problem. Avatar pedestal mechanism lacks ability, people can't get any information about that avatar (excluding its preview image).
So, for example, avatar creator can't use materials licensed under Creative Commons "CC BY" which requires providing appropriate credit. There's no place to note for that purpose.
I think we need some UI elements in pedestal mechanism to see these information before use its avatar.