PT-2026-25397 · Unknown · Anything-Llm

U-Ktdi · Publicado 2026-03-13 · Atualizado 2026-03-16 · CVE-2026-32717

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). In multi-user mode, the application fails to block suspended users accessing the system through browser extension API keys, despite blocking them through standard JWT-backed sessions. A suspended user with a valid brx-... browser extension API key can continue to access browser extension endpoints, read workspace metadata, and perform upload or embed operations. The vulnerable API key path allows continued access even after normal authentication is denied.

Recommendations Versions prior to 1.11.1 should be updated. Ensure that browser extension API keys are invalidated or access is revoked upon user suspension.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2026-04253

CVE-2026-32717

GHSA-7754-8JCC-2RG3

Produtos afetados

Anything-Llm

Referências · 8

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32717.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/a207449095158f28c7e16acf113356b336c87803 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-32717 · Nota de Segurança
• https://t.me/CVEtracker/47391 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-32717 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605819213062642 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-04253 · Nota de Segurança