Sensitive-info exposure in anything-llm setup-complete (CVE-2024-6842)
Date: 2024
Affected: mintplex-labs/anything-llm 1.5.5
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High

anything-llm 1.5.5 /setup-complete API allows unauthorized users to access sensitive system settings including API keys for search engines.


Mitigations:

Architectural layers (MAESTRO):