AnythingLLM privilege escalation: default-role users delete admin documents
Date: 2024-02
Affected: anything-llm
Attack vector: auth-bypass
Category: real-world
Severity: Medium
CVE: CVE-2024-1602
CVSS: 6.5 ()

Privilege escalation in mintplex-labs/anything-llm: 'default' role users can delete documents uploaded by 'admin' via a crafted DELETE request to /api/system/remove-document.


Mitigations:

Architectural layers (MAESTRO):