Exposure of Sensitive Information in mintplex-labs/anything-llm
Priority HIGH 72CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.36276 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mintplex-labs/anything-llm (mintplex-labs): 1.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | before 1.0.2 | 1.0.2 | Patch available | CNA |
- mintplex-labs/anything-llm Vendormintplex-labs Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mintplexlabs:anythingllm:1.5.5:*:*:*:*:*:*:* | 1.5.5 | Vulnerable | mintplex-labs |
- cpe:2.3:a:mintplexlabs:anythingllm:1.5.5:*:*:*:*:*:*:* Versions 1.5.5 Vulnerable ·mintplex-labs
Remediation
- Fix · CNA mintplex-labs/anything-llm (mintplex-labs) Fixed in 1.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6842
- 2026-10-03 Alias added: GHSA-p868-p9pj-fvmr
References
More mintplex-labs Anythingllm vulnerabilities
- TI-2024-02840 Improper Authorization in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.4
- TI-2024-03075 Improper Access Control in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.1
- TI-2023-05368 Improper Input Validation in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.1
- TI-2026-19731 AnythingLLM has key leak in `systemSettings.js` CVSS 4.0HIGH 8.7
- TI-2024-02907 Remote Code Execution in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.8
- TI-2024-02832 Path Traversal in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.9
Sources
- CVE-2024-6842 · CVE Program
- CVE-2024-6842 · NVD
- FIRST EPSS
- GHSA-p868-p9pj-fvmr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences