AnythingLLMPublished 2 Mar 2024NVD status: Analyzed

CVE-2024-0795

AnythingLLM: If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this…

ComponentAnythingLLM
Severityhigh (CVSS 7.2)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published (NVD)2024-03-02
Last modified2026-06-17
Affected versions
< 1.0.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.0.0
WeaknessCWE-284
CISA KEVnot listed

NVD description

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this new account to have elevated privileges on the instance

What to do

  • Upgrade AnythingLLM to 1.0.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources