Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

AnythingLLM v1.8.5 Exposes Workspace Info to Unauthenticated Users

CVE-2025-63390 · published 10 months ago
Summary

A security issue in AnythingLLM v1.8.5 allows anyone to access sensitive information about workspaces without logging in. This includes details like workspace names and settings. Update to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mintplexlabs anythingllm 1.8.5
cpe:2.3:a:mintplexlabs:anythingllm:1.8.5:*:*:*:*:*:*:*
Original advisory text
An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remot...
An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed data includes: workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published18 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-63390 · NVD
CVE-2025-63390 · OSV
Track software like this
Free during beta