AnythingLLM CVE-2026-42456
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible IDOR requiring authenticated workspace membership (PR:L); impact limited to partial confidentiality of chat audio with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for another user's chat response within the same workspace because the route validates workspace membership but does not enforce ownership of the targeted chat row. As a result, an authenticated user can access another user's private assistant response in audio form if the chatId is known or guessed. This constitutes an insecure direct object reference (IDOR) affecting private chat response content exposed through the TTS endpoint. This issue has been patched in version 1.12.1.
AnalysisAI
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing any authenticated workspace member to retrieve audio renderings of another user's private chat responses by supplying a foreign chatId. The route validated workspace membership but omitted per-row ownership enforcement, making lateral access within a shared workspace trivial for a low-privileged attacker. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies exploitation as poc-level, and EPSS is negligible at 0.01%, consistent with a targeted rather than opportunistic threat.
Technical ContextAI
AnythingLLM (CPE: cpe:2.3:a:mintplex-labs:anything-llm:*:*:*:*:*:*:*:*) is a Node.js multi-user LLM application that stores chat exchanges and can convert assistant responses to audio via a text-to-speech subsystem. The vulnerable route, GET /api/workspace/:slug/tts/:chatId in server/endpoints/workspaces.js, accepted a user-controlled chatId path parameter and queried the workspace_chats table using only workspace slug membership as an authorization gate. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies - the application unintentionally disclosed a resource owned by another principal because the query lacked a user_id filter. The fix in commit 4f3f77119d calls userFromSession() to extract the requesting user's identity and adds user_id as an additional predicate when fetching the chat row, returning 404 if no matching owned record exists.
RemediationAI
Upgrade AnythingLLM to version 1.12.1, which resolves the vulnerability by enforcing chat record ownership in the TTS endpoint (commit 4f3f77119d342e5489d1ba7533ad6d51bdcd565f; release: https://github.com/Mintplex-Labs/anything-llm/releases/tag/v1.12.1). If an immediate upgrade is not feasible, administrators can block the /api/workspace/:slug/tts/:chatId route at the reverse proxy layer, though this disables TTS playback for all workspace users. Alternatively, restricting workspace membership exclusively to fully trusted principals removes the cross-user threat surface while preserving functionality - note that this is an organizational control, not a technical one, and does not remediate the underlying code defect.
More in Anything Llm
View allSQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev
XSS in AnythingLLM 1.11.1 and earlier.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an ag
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today