VYPR
← All advisories
Low severity3.8NVD Advisory· Published Mar 16, 2026· Updated Jun 17, 2026

CVE-2026-32715

CVE-2026-32715

Description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Mintplex Labs/Anythingllm3 versions
    cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*range: <=1.11.1
    • (no CPE)range: <=1.11.1
    • (no CPE)range: <= 1.11.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.