AnythingLLM CVE-2026-42456

Exploitation requires the attacker to hold a valid authenticated session within the target AnythingLLM instance and be a member of the same workspace as the victim (PR:L - standard workspace credentials, not administrator access). The attacker must know or successfully enumerate a valid chatId belonging to another user's chat record in that workspace. The TTS feature must have been exercised by the target user (i.e., audio must have been generated for the target chat). Exploitation is limited by: the authentication barrier (unauthenticated attackers cannot reach this endpoint), the shared-workspace constraint (attacker and victim must occupy the same workspace), chatId discovery friction (guessing or iterating valid IDs), and the impact ceiling (audio of assistant responses only - user-authored content and other data are not exposed by this route).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) accurately characterizes the flaw: network reachable, low complexity, but gated behind valid authentication and producing only limited confidentiality impact. EPSS at 0.01% (1st percentile) aligns with the low real-world exploitation signal - no mass scanning tooling targets this specific endpoint. SSVC qualifies exploitation as poc and automatable as no, meaning that while the attack is conceptually straightforward, it requires the attacker to discover or iterate valid chatIds rather than fire-and-forget. KEV absence further confirms no confirmed in-the-wild abuse. The aggregate picture is a real but low-priority vulnerability: meaningful within multi-tenant or shared-workspace deployments where users do not fully trust their co-workers, but of negligible risk in single-user or organizationally homogeneous deployments.

An authenticated AnythingLLM workspace member sends sequential or enumerated GET requests to /api/workspace/target-workspace/tts/:chatId, iterating integer or UUID chatId values to retrieve audio playback of other workspace members' private assistant responses. Because chatIds may be sequential or otherwise predictable, low-effort enumeration is feasible. SSVC notes a POC-level exploitation baseline, meaning the attack requires no specialized tooling beyond a scripted HTTP client.