CVE-2024-0439: Mintplexlabs AnythingLLM Auth Bypass Flaw

CVE-2024-0439 Overview

CVE-2024-0439 is a broken access control vulnerability in Mintplex Labs AnythingLLM. Users assigned the manager role can modify system settings that should be restricted to administrators. The user interface hides these settings from managers, but the server does not enforce the same restriction at the API layer. Any authenticated manager can send a direct HTTP request with their token and update environment configuration values through the updateENV endpoint. This results in a vertical privilege escalation from the manager role to administrative capabilities. The flaw is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
An authenticated user with the manager role can bypass UI-based access controls and modify administrator-only settings through direct HTTP requests, effectively escalating privileges within the AnythingLLM instance.

Affected Products

Mintplex Labs AnythingLLM (versions prior to the fix in commit 7200a06)
Deployments running in multi-user mode
Instances exposing the /system endpoints to non-admin authenticated users

Discovery Timeline

2024-02-26 - CVE-2024-0439 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0439

Vulnerability Analysis

AnythingLLM implements role-based access control in multi-user mode, with admin and manager roles among others. The application hides sensitive configuration controls from managers in the front-end UI. However, the corresponding server route protecting updateENV only checked for a valid session and the flexUserRoleValid middleware, which permits managers. No explicit role check ensured that the caller was an administrator before persisting environment changes.

Because managers hold valid JWT tokens, they can issue HTTP requests directly to the endpoint and modify settings such as LLM provider credentials, embedded model configuration, and other environment values. This grants managers control over the application backend that the product design intended to reserve for administrators.

Root Cause

The root cause is a missing authorization check on the server-side handler that processes environment updates. The middleware chain validated authentication and permitted flexible roles, but did not compare the caller's role against admin before invoking updateENV. Relying on the UI to hide functionality left the API endpoint unprotected.

Attack Vector

An attacker requires manager-level credentials on a multi-user AnythingLLM instance. Using a captured or issued JWT, the attacker sends an authenticated HTTP request to the system settings endpoint with a JSON body containing new environment values. The server accepts the request, writes the values, and, in production, persists them via dumpENV().

javascript

// Patch: server/endpoints/system.js
// Source: https://github.com/mintplex-labs/anything-llm/commit/7200a06ef07d92eef5f3c4c8be29824aa001d688
     [validatedRequest, flexUserRoleValid],
     async (request, response) => {
       try {
+        const user = await userFromSession(request, response);
+        if (!!user && user.role !== "admin") {
+          response.sendStatus(401).end();
+          return;
+        }
+
         const body = reqBody(request);
         const { newValues, error } = updateENV(body);
         if (process.env.NODE_ENV === "production") await dumpENV();

The fix adds a lookup for the session user via a new helper in server/utils/http/index.js and rejects any non-admin caller with HTTP 401.

javascript

// Patch: server/utils/http/index.js
// Source: https://github.com/mintplex-labs/anything-llm/commit/7200a06ef07d92eef5f3c4c8be29824aa001d688
   return JWT.sign(info, process.env.JWT_SECRET, { expiresIn: expiry });
 }
 
+// Note: Only valid for finding users in multi-user mode
+// as single-user mode with password is not a "user"
 async function userFromSession(request, response = null) {
   if (!!response && !!response.locals?.user) {
     return response.locals.user;

Detection Methods for CVE-2024-0439

Indicators of Compromise

HTTP requests to system settings endpoints (for example, paths handling updateENV) originating from JWTs associated with manager-role accounts.
Unexpected changes to environment configuration or .env values on the AnythingLLM host outside of administrator activity windows.
Elevated volume of POST or PUT traffic to /api/system routes from non-admin sessions.

Detection Strategies

Review AnythingLLM server logs for successful non-admin requests to the updateENV handler prior to applying the patch.
Correlate session tokens with role claims and flag any state-changing request where the role is not admin.
Baseline legitimate administrator source IP addresses and alert on configuration changes originating from other addresses.

Monitoring Recommendations

Forward AnythingLLM application logs and reverse-proxy access logs to a centralized logging platform for retention and query.
Monitor for modifications to environment variables, LLM provider keys, and integration secrets stored by AnythingLLM.
Alert on any HTTP 200 response to system configuration endpoints paired with a session belonging to a non-admin user.

How to Mitigate CVE-2024-0439

Immediate Actions Required

Upgrade AnythingLLM to a build that includes commit 7200a06ef07d92eef5f3c4c8be29824aa001d688 or later.
Audit all manager-role accounts and review recent changes to environment configuration for unauthorized modifications.
Rotate any credentials, API keys, or secrets stored in the AnythingLLM environment if manager accounts may have been misused.

Patch Information

Mintplex Labs addressed the issue in commit 7200a06. The patch introduces userFromSession() and rejects any request to updateENV where the caller's role is not admin, returning HTTP 401. The bounty record is available at the Huntr disclosure page.

Workarounds

Restrict the AnythingLLM administrative endpoints at the reverse proxy or ingress layer so they are only reachable from trusted networks.
Downgrade or remove manager-role assignments from users who do not require elevated capabilities until the patched build is deployed.
Deploy AnythingLLM in single-user mode where multi-user role separation is not required, eliminating the manager role entirely.

bash

# Example: nginx restriction limiting /api/system to trusted admin network
location /api/system {
    allow 10.0.0.0/24;   # admin management subnet
    deny all;
    proxy_pass http://anythingllm_backend;
}