Critical severity9.8NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-8196

Description

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mintplex Labs/Anythingllm Desktop
cpe:2.3:a:mintplexlabs:anythingllm_desktop:*:*:*:*:*:*:*:*
Range: <1.6.5
Mintplex Labs/Anythingllmllm-fuzzy
Range: <=1.5.11
mintplex-labs/mintplex-labs/anything-llmv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/mintplex-labs/anything-llm/commit/9bfe477f10b188bfe3508ac29105df80d4522ecenvdPatch
huntr.com/bounties/dbde1c71-7aa5-46f6-847a-d89793cf97a9nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000