PT-2026-25396 · Unknown · Anything-Llm

U-Ktdi · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32715

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). A discrepancy exists where two generic system-preferences API endpoints, ''/system-preferences'' and ''/system-preferences/{id}'', allow access to users with the manager role, while other interfaces for the same settings are restricted to administrators. This inconsistency allows a manager to directly access plaintext SQL database credentials and modify administrator-only global settings, including the default system prompt and the Community Hub API key. The vulnerable parameters are not explicitly mentioned.

Recommendations Versions prior to 1.11.1 should be updated. As a temporary workaround, restrict direct access to the ''/system-preferences'' and ''/system-preferences/{id}'' API endpoints for manager roles.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-04252

CVE-2026-32715

GHSA-WFQ3-65GM-3G2P

Affected Products

Anything-Llm

References · 8

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-wfq3-65gm-3g2p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32715.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/732eac6fa89f43288bbb65ecc6298ebcd96b7aeb · Patch
• https://bdu.fstec.ru/vul/2026-04252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32715 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32715 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032605820353945633 · Twitter Post
• https://t.me/CVEtracker/47390 · Telegram Post