Executive brief
AnythingLLM is an application that converts documents and content into context for AI chat interactions. A security flaw exists where mobile device access tokens created when the system is in "single-user" mode remain valid after the system is upgraded to "multi-user" mode. This allows an attacker with a legacy token to bypass privacy controls and view private chat histories and workspace data belonging to other users.
Technical details
An authorization bypass exists in AnythingLLM due to improper handling of mobile device tokens during mode migration. In single-user mode, mobile device records are created with a null 'userId'. When the application is migrated to multi-user mode, the mobile authentication middleware continues to accept these stale tokens. Because no user is associated with the request, downstream handlers default to unscoped data-access branches rather than applying per-user filters. This allows an attacker possessing a pre-migration token to enumerate workspaces and retrieve chat metadata and content belonging to other users. The issue is fixed in version 1.13.0 by ensuring device tokens are correctly associated with an admin user during migration.
Affected products
- Mintplex Labs AnythingLLM < 1.13.0
Timeline
- 2026-04-29: other: Vulnerability validated by researcher
- 2026-05-19: advisory: Vendor advisory published via GitHub
- 2026-05-28: disclosed: CVE published to NVD