What’s Vulnerable › Vulnerabilities

CVE-2024-13060: Improper Authorization in mintplex-labs/anything-llm

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-862

Description

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Affected products

• Mintplexlabs Anythingllm Docker: before 1.3.1 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: Mintplexlabs Anythingllm Docker 1.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45a
• https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f
• https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f

Get alerted when CVE-2024-13060 or the next vulnerability affects your stack