CVE-2026-32891

| EUVD-2026-13503 CRITICAL
2026-03-20 [email protected]
9.0
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 20, 2026 - 08:37 vuln.today
EUVD ID Assigned
Mar 20, 2026 - 08:37 euvd
EUVD-2026-13503
CVE Published
Mar 20, 2026 - 03:16 nvd
CRITICAL 9.0

Tags

XSS

Description

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.

Analysis

A stored cross-site scripting (XSS) vulnerability in Anchorr Discord bot versions 1.4.1 and below allows authenticated Jellyseerr users to execute arbitrary JavaScript in admin browser sessions. The XSS payload can exfiltrate the full application configuration including session tokens and API keys for integrated services (Jellyfin, Jellyseerr, Discord), enabling complete account takeover across all connected platforms without requiring admin credentials. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Immediately disable or isolate the Anchorr Discord bot from production; audit access logs for unauthorized activity and review all connected service tokens for compromise. Within 7 days: Rotate all API keys, session tokens, and credentials for Jellyfin, Jellyseerr, and Discord; conduct a forensic review of configuration changes and data access patterns. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +45
POC: 0

Share

CVE-2026-32891 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy