PT-2026-1141 · Unknown · Anything-Llm

Denizparlak · Published 2026-01-03 · Updated 2026-04-17 · CVE-2026-21484

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM (affected versions not specified)

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery functionality exposed different error messages based on the existence of a username, allowing for username enumeration. The /password-recovery API endpoint was vulnerable to this issue. This allowed an attacker to determine valid usernames by observing the response to requests with different username values.

Recommendations Update to a version after commit e287fab56089cf8fcea9ba579a3ecdeca0daa313.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2026-21484

GHSA-47VR-W3VM-69CH

Affected Products

Anything-Llm

References · 10

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21484.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313 · Patch
• https://osv.dev/vulnerability/CVE-2026-21484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21484 · Security Note
• https://t.me/cveNotify/152887 · Telegram Post
• https://t.me/cveNotify/147640 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2045064757661847796 · Twitter Post
• https://t.me/CVEtracker/41309 · Telegram Post
• https://twitter.com/CVEnew/status/2007285647070154779 · Twitter Post