PT-2026-26545 · Anchor · Anchor

Xdnewlun1 · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32890

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anchorr versions 1.4.1 and below

Description Anchorr is a Discord bot used for requesting movies and TV shows and receiving notifications about media server updates. A stored Cross-site Scripting (XSS) issue exists in the web dashboard's User Mapping dropdown, allowing any unprivileged Discord user within the configured guild to execute arbitrary JavaScript in the Anchorr administrator's browser. This can be chained with the GET /api/config endpoint, which returns all secrets in plaintext. An attacker can potentially exfiltrate credentials including DISCORD TOKEN, JELLYFIN API KEY, JELLYSEERR API KEY, JWT SECRET, WEBHOOK SECRET, and bcrypt password hashes without authentication to Anchorr.

Recommendations Update to version 1.4.2 or later.

Exploit

Correção

Information Disclosure

XSS

Enumeração de Fraquezas

CWE-200

CWE-79

Identificadores relacionados

CVE-2026-32890

GHSA-QPMQ-6WJC-W28Q

Produtos afetados

Anchor

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32890.json · Exploit
• 🔥 https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q · Exploit
• https://github.com/openVESSL/Anchorr/commit/d5ae67e5b455241274ed0072cf2db43a6eb3f0b2 · Correção
• https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2 · Nota
• https://twitter.com/CVEnew/status/2034841436575998416 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32890 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2035521904237490482 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2034838084798366102 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034897883409862806 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32890 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2035063649576931532 · Publicação no Twitter