PT-2026-25397 · Unknown · Anything-Llm

U-Ktdi · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32717

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). In multi-user mode, the application fails to block suspended users accessing the system through browser extension API keys, despite blocking them through standard JWT-backed sessions. A suspended user with a valid brx-... browser extension API key can continue to access browser extension endpoints, read workspace metadata, and perform upload or embed operations. The vulnerable API key path allows continued access even after normal authentication is denied.

Recommendations Versions prior to 1.11.1 should be updated. Ensure that browser extension API keys are invalidated or access is revoked upon user suspension.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-04253

CVE-2026-32717

GHSA-7754-8JCC-2RG3

Affected Products

Anything-Llm

References · 8

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32717.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/a207449095158f28c7e16acf113356b336c87803 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32717 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32717 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04253 · Security Note
• https://t.me/CVEtracker/47391 · Telegram Post
• https://twitter.com/CVEnew/status/2032605819213062642 · Twitter Post