What’s Vulnerable › Vulnerabilities
CVE-2024-0439: User can manually send request at manager permission to modify system configurations
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-02-26 · updated 2026-06-17
- Weakness: CWE-269
Description
As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request While this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level.
Affected products
- Mintplexlabs Anythingllm: before 1.0.0 — fixed in 1.0.0
How to fix
Upgrade to a fixed version: Mintplexlabs Anythingllm 1.0.0. Check the vendor advisory for mitigations.
References
- https://github.com/mintplex-labs/anything-llm/commit/7200a06ef07d92eef5f3c4c8be29824aa001d688
- https://huntr.com/bounties/7fc1b78e-7faf-4f40-961d-61e53dac81ce
- https://github.com/mintplex-labs/anything-llm/commit/7200a06ef07d92eef5f3c4c8be29824aa001d688
- https://huntr.com/bounties/7fc1b78e-7faf-4f40-961d-61e53dac81ce
Get alerted when CVE-2024-0439 or the next vulnerability affects your stack