Read the docs
TI-2026-25350 Aliases CVE-2026-32891

Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS

Priority HIGH 74CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-311 and CWE-80.

Summary

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed Anchorr (openVESSL): 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openVESSLAnchorrbefore 1.4.21.4.2Patch availableCNA
  • Anchorr VendoropenVESSL Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:*up to 1.4.1VulnerableopenVESSL
  • cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:* Versions up to 1.4.1 Vulnerable ·openVESSL

Remediation

  • Fix · CNA Anchorr (openVESSL) Fixed in 1.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32891

References

Advisory 1

Other 1

  • TI-2026-25349 Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config CVSS 3.1CRITICAL 9.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences