Medium severity4.3NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-13060

Description

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AnythingLLM/AnythingLLM Desktopllm-fuzzy
Range: <1.3.1
mintplex-labs/mintplex-labs/anything-llmv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45anvdPatch
huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8fnvdExploit

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000