Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.8

AnythingLLM Manager Role Can Access Sensitive Settings

CVE-2026-32715 · published 7 months ago
Summary

The AnythingLLM application has a security issue where managers can access sensitive settings that should only be available to administrators. This could allow unauthorized access to database credentials and other important settings. Update to the latest version of AnythingLLM to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mintplexlabs anythingllm <= 1.11.1
cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*
Original advisory text
AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.8 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published13 Mar 2026
Updated30 Oct 2026
First seen14 Mar 2026
Sources
CVE-2026-32715 · OSV
GHSA-wfq3-65gm-3g2p · GHSA
CVE-2026-32715 · NVD
Track software like this
Free during beta