PT-2026-26545 · Anchor · Anchor

Xdnewlun1 · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32890

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anchorr versions 1.4.1 and below

Description Anchorr is a Discord bot used for requesting movies and TV shows and receiving notifications about media server updates. A stored Cross-site Scripting (XSS) issue exists in the web dashboard's User Mapping dropdown, allowing any unprivileged Discord user within the configured guild to execute arbitrary JavaScript in the Anchorr administrator's browser. This can be chained with the GET /api/config endpoint, which returns all secrets in plaintext. An attacker can potentially exfiltrate credentials including DISCORD TOKEN, JELLYFIN API KEY, JELLYSEERR API KEY, JWT SECRET, WEBHOOK SECRET, and bcrypt password hashes without authentication to Anchorr.

Recommendations Update to version 1.4.2 or later.

Exploit

Fix

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

CVE-2026-32890

GHSA-QPMQ-6WJC-W28Q

Affected Products

Anchor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32890.json · Exploit
• 🔥 https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q · Exploit
• https://github.com/openVESSL/Anchorr/commit/d5ae67e5b455241274ed0072cf2db43a6eb3f0b2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32890 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32890 · Vendor Advisory
• https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2 · Note
• https://twitter.com/CVEnew/status/2034841436575998416 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035521904237490482 · Twitter Post
• https://twitter.com/CveFindCom/status/2034838084798366102 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034897883409862806 · Twitter Post
• https://twitter.com/0dayPublishing/status/2035063649576931532 · Twitter Post