In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multi_user_mode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This action permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access.
References
Link | Resource |
---|---|
https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 | Patch |
https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc | Exploit Third Party Advisory |
https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 | Patch |
https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc | Exploit Third Party Advisory |
Configurations
History
09 Jul 2025, 19:49
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - Patch | |
References | () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
First Time |
Mintplexlabs
Mintplexlabs anythingllm |
|
CWE | NVD-CWE-noinfo |
21 Nov 2024, 09:28
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
References | () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - | |
References | () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - |
10 Apr 2024, 17:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-10 17:15
Updated : 2025-07-09 19:49
NVD link : CVE-2024-3101
Mitre link : CVE-2024-3101
CVE.ORG link : CVE-2024-3101
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE