PT-2026-1141 · Unknown · Anything-Llm

Denizparlak · Published 2026-01-03 · Updated 2026-02-23 · CVE-2026-21484

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM (affected versions not specified)

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). Prior to commit

e287fab56089cf8fcea9ba579a3ecdeca0daa313

, the password recovery functionality exposed different error messages based on the existence of a username, allowing for username enumeration. The

/password-recovery

API endpoint was vulnerable to this issue. This allowed an attacker to determine valid usernames by observing the response to requests with different

username

values.

Recommendations Update to a version after commit

e287fab56089cf8fcea9ba579a3ecdeca0daa313

.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2026-21484

GHSA-47VR-W3VM-69CH

Affected Products

Anything-Llm

References · 9

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21484.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313 · Patch
• https://osv.dev/vulnerability/CVE-2026-21484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21484 · Security Note
• https://t.me/CVEtracker/41309 · Telegram Post
• https://twitter.com/CVEnew/status/2007285647070154779 · Twitter Post
• https://t.me/cveNotify/152887 · Telegram Post
• https://t.me/cveNotify/147640 · Telegram Post