TI-2024-04838 Aliases CVE-2024-5213 GHSA-c72r-fww5-rpch

Exposure of Sensitive Information in mintplex-labs/anything-llm

LOW 29CWE-201Published 2024-06-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-201.

Summary

In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00462 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mintplex-labs/anything-llm (mintplex-labs): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mintplex-labs	mintplex-labs/anything-llm	before 1.0.0	1.0.0	Patch available	CNA

mintplex-labs/anything-llm Vendormintplex-labs Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mintplexlabs:anythingllm::::::::	up to 1.5.3	Vulnerable	mintplex-labs

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* Versions up to 1.5.3 Vulnerable ·mintplex-labs

Remediation

Fix · CNA mintplex-labs/anything-llm (mintplex-labs) Fixed in 1.0.0

Timeline

2026-10-02 Threatist record created from CVE-2024-5213
2026-10-03 Alias added: GHSA-c72r-fww5-rpch

References

Exploit 1

https://huntr.com/bounties/8794fb65-50aa-40e3-b348-a29838dbf63d

Patch 1

https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c

TI-2024-02840 Improper Authorization in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.4
TI-2024-03075 Improper Access Control in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.1
TI-2023-05368 Improper Input Validation in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.1
TI-2026-19731 AnythingLLM has key leak in `systemSettings.js` CVSS 4.0HIGH 8.7
TI-2024-02907 Remote Code Execution in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.8
TI-2024-02832 Path Traversal in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.9

See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences