Executive brief
AnythingLLM is an application that allows users to interact with AI models using their own documents and data. A security flaw in the text-to-speech (TTS) feature allows an authorized user in a shared workspace to listen to the private AI chat responses of other users. This could lead to the exposure of sensitive business information or private conversations if an attacker guesses or obtains a specific chat ID.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `GET /api/workspace/:slug/tts/:chatId` endpoint. While the application correctly verifies that the requesting user is a member of the specified workspace, it fails to verify that the `chatId` belongs to the authenticated user. By providing a known or guessed `chatId` belonging to another user, an attacker can retrieve the generated text-to-speech audio of that user's private assistant response. The root cause is located in `server/endpoints/workspaces.js`, where the database query for the chat record did not include a `user_id` constraint. This has been patched in version 1.12.1 by enforcing ownership checks during the lookup.
Affected products
- Mintplex Labs AnythingLLM Desktop <= 1.11.1
- Mintplex Labs AnythingLLM Docker <= 1.11.1
Timeline
- 2026-04-22: advisory: GitHub Security Advisory GHSA-jwqg-jfg3-x5vv published
- 2026-04-22: patched: Fix committed and version 1.12.1 released
- 2026-05-08: disclosed: CVE-2026-42456 published to NVD