Vulnerability in AnythingLLM Application by Mintplex Labs

CVE-2026-32715

What is CVE-2026-32715?

The AnythingLLM application, developed by Mintplex Labs, presents a significant access control vulnerability in versions 1.11.1 and earlier. Due to inconsistent permissions on two generic system-preferences endpoints, users with a manager role can access sensitive configurations that should be restricted to administrators. This flaw allows managers to directly read plaintext SQL database credentials and modify critical settings, including the default system prompt and Community Hub API key, potentially leading to unauthorized control over the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References