PT-2024-15530 · Mintplex · Anything-Llm

Published 2024-04-15 · Updated 2025-07-09 · CVE-2024-0404

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm repository (affected versions not specified)

Description A mass assignment vulnerability exists in the "/api/invite/:code" endpoint, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a role property with admin value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the /api/invite/:code endpoint until a patch is available. Restrict access to the account creation process via invitation links to minimize the risk of exploitation. Avoid using the role property in the affected API endpoint until the issue is resolved.

Exploit

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2024-0404

Affected Products

Anything-Llm

References · 8

• 🔥 https://huntr.com/bounties/b4355bae-766a-4bb0-942b-607bc491b23d · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/8cd3a92c660b202655d99bee90b2864694c99946 · Patch
• https://osv.dev/vulnerability/CVE-2024-0404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0404 · Security Note
• https://t.me/cvenotify/76885 · Telegram Post
• https://t.me/cvenotify/128271 · Telegram Post
• https://twitter.com/CVEnew/status/1780039228816237019 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1780116080796614945 · Twitter Post