Create user API role not enforced
Priority HIGH 67CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00945 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mintplex-labs/anything-llm (mintplex-labs): 1.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | before 1.0.0 | 1.0.0 | Patch available | CNA |
- mintplex-labs/anything-llm Vendormintplex-labs Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | before 1.0.0 | Vulnerable | mintplex-labs |
- cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·mintplex-labs
Remediation
- Fix · CNA mintplex-labs/anything-llm (mintplex-labs) Fixed in 1.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0795
- 2026-10-03 Alias added: GHSA-78cj-mhpr-2qfm
References
More mintplex-labs Anythingllm vulnerabilities
- TI-2024-02840 Improper Authorization in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.4
- TI-2024-03075 Improper Access Control in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.1
- TI-2023-05368 Improper Input Validation in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.1
- TI-2026-19731 AnythingLLM has key leak in `systemSettings.js` CVSS 4.0HIGH 8.7
- TI-2024-02907 Remote Code Execution in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.8
- TI-2024-02832 Path Traversal in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.9
Sources
- CVE-2024-0795 · CVE Program
- CVE-2024-0795 · NVD
- FIRST EPSS
- GHSA-78cj-mhpr-2qfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences