CVE-2024-0795

Create user API role not enforced

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance

Affected

mintplex-labs · mintplex-labs/anything-llm

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 HUNTR

7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.95% chance of exploitation in the next 30 days, 60th percentile

Published

2024-03-02

Updated

2024-08-15

Proof-of-concept exploits (1)

• https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec

Security advisories

• mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564

References

• CVE Record
• NVD entry