| Component | AnythingLLM |
| Severity | low (CVSS 2.7) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| Published (NVD) | 2026-03-16 |
| Last modified | 2026-06-17 |
| Affected versions | anythingllm <= 1.11.1 |
| Fixed in | see the vendor advisory |
| Weakness | CWE-863 |
| CISA KEV | not listed |
NVD description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API key path. If a user already has a valid brx-... browser extension API key, that key continues to work after suspension. As a result, a suspended user can still access browser extension endpoints, read reachable workspace metadata, and continue upload or embed operations even though normal authenticated requests are rejected.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep AnythingLLM off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-32717
- https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3
- https://github.com/Mintplex-Labs/anything-llm/commit/a207449095158f28c7e16acf113356b336c87803
Other AnythingLLM CVEs
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and ea...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1....
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...