PT-2026-44551 · Unknown · Anything-Llm

C4Tzzz · CVE-2026-47713 · Published 2026-05-28 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM versions prior to 1.13.0

Description An issue exists where a mobile device token created in single-user mode remains valid after migration to multi-user mode, even if the device record has userId set to null. The mobile authentication middleware continues to accept this stale token. Since no user is associated with the request, mobile handlers use unscoped data-access branches, returning workspaces and content without per-user filtering. This allows a pre-migration token to enumerate workspaces assigned to other users and retrieve thread metadata and chat content.

Recommendations Update to version 1.13.0.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-47713

GHSA-H349-HP2V-8RHW

Affected Products

Anything-Llm

References · 7

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-h349-hp2v-8rhw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47713.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/9d714f95c124b61df00b840e36f623a2eb7e7eb4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47713 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47713 · Vendor Advisory
• https://t.me/cveNotify/208551 · Telegram Post
• https://t.me/cveNotify/165825 · Telegram Post