ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32715

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

Published Mar 16, 2026 · updated Jun 17, 2026 · mintplexlabs anythingllm

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 16, 2026 · NIST NVD

    Detected

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaint

  2. Jun 17, 2026 · NIST NVD

    Updated

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaint

Affected

  • cpe mintplexlabs/anythingllmversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32715

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32715

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is r

    nvd.nist.gov

References