Read the docs
TI-2026-25349 Aliases CVE-2026-32890

Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config

Priority HIGH 76CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-79.

Summary

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix Fixed Anchorr (openVESSL): 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openVESSLAnchorrbefore 1.4.21.4.2Patch availableCNA
  • Anchorr VendoropenVESSL Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:*up to 1.4.1VulnerableopenVESSL
  • cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:* Versions up to 1.4.1 Vulnerable ·openVESSL

Remediation

  • Fix · CNA Anchorr (openVESSL) Fixed in 1.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32890
  2. 2026-10-18 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2026-25350 Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences