CVE-2024-0551: Mintplexlabs AnythingLLM Auth Bypass Vulnerability

CVE-2024-0551 Overview

CVE-2024-0551 is an improper access control vulnerability [CWE-284] in Mintplex Labs anything-llm. The /system/data-export endpoint enforced only base request validation, allowing any authenticated user, including those assigned the default role, to trigger a full database export. An attacker with prior access to the instance can invoke the endpoint and download the generated archive before the application deletes it.

Critical Impact
Any authenticated low-privilege user of AnythingLLM can export the full system database and download it through the predictable export path, leading to disclosure of workspace data, configurations, and stored content.

Affected Products

Mintplex Labs anythingllm versions prior to the fixed commit 7aaa4b3
Self-hosted AnythingLLM deployments exposing the /system/data-export route
Multi-user AnythingLLM instances relying on the default user role for access separation

Discovery Timeline

2024-02-27 - CVE-2024-0551 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0551

Vulnerability Analysis

AnythingLLM exposes an administrative data-export capability through the /system/data-export HTTP GET endpoint. Prior to the patch, this route was guarded only by the validatedRequest middleware, which confirms that the caller holds a valid session token. It did not verify the caller's role. As a result, any authenticated user, including accounts provisioned with the default (non-administrator) role, could invoke the endpoint and cause the server to generate a database export.

The export is written to storage/exports/ and is retrievable through /system/data-exports/:filename. The generated filename is deterministic, which shortens the window an attacker needs to guess or race the download. The vendor note observes that the UI initiates the download at export creation time and deletes the archive from disk after retrieval, which limits, but does not eliminate, the exposure window for an attacker driving the endpoint directly.

Root Cause

The root cause is missing role-based authorization on a privileged administrative route. The endpoint checked authentication but not authorization, violating the principle of least privilege for multi-tenant AnythingLLM deployments.

Attack Vector

An attacker who already possesses valid credentials, for example a default-role user in a multi-user AnythingLLM instance, sends an authenticated HTTP GET request to /system/data-export. The server responds with a JSON payload containing the export filename. The attacker then requests /system/data-exports/<filename> to retrieve the archive.

javascript

     }
   });
 
-  app.get("/system/data-export", [validatedRequest], async (_, response) => {
-    try {
-      const { filename, error } = await exportData();
-      response.status(200).json({ filename, error });
-    } catch (e) {
-      console.log(e.message, e);
-      response.sendStatus(500).end();
+  app.get(
+    "/system/data-export",
+    [validatedRequest, flexUserRoleValid],
+    async (_, response) => {
+      try {
+        const { filename, error } = await exportData();
+        response.status(200).json({ filename, error });
+      } catch (e) {
+        console.log(e.message, e);
+        response.sendStatus(500).end();
+      }
     }
-  });
+  );
 
   app.get("/system/data-exports/:filename", (request, response) => {
     const exportLocation = __dirname + "/../storage/exports/";

Source: GitHub Commit 7aaa4b3 — the patch adds the flexUserRoleValid middleware to the /system/data-export route so that the export handler runs only for users at or above the required role tier.

Detection Methods for CVE-2024-0551

Indicators of Compromise

HTTP GET requests to /system/data-export originating from user sessions that do not belong to administrator accounts.
HTTP GET requests to /system/data-exports/<filename> where the filename does not correspond to an admin-initiated UI action.
Unexpected files created in the AnythingLLM storage/exports/ directory outside of scheduled or admin-driven exports.

Detection Strategies

Enable and centralize access logs from the AnythingLLM reverse proxy or Node.js server, then alert on any authenticated request to the export endpoints.
Correlate the requesting session identifier with the user's role in the AnythingLLM database to flag exports initiated by non-admin users.
Baseline the normal frequency of export operations in production; treat any off-hours or scripted access patterns as suspicious.

Monitoring Recommendations

Monitor file creation events in storage/exports/ and pair them with the initiating HTTP request in the application log.
Track outbound bandwidth associated with the AnythingLLM process to identify large archive downloads by non-administrative accounts.
Review authentication logs to detect newly created or dormant low-privilege accounts issuing calls to /system/data-export.

How to Mitigate CVE-2024-0551

Immediate Actions Required

Upgrade AnythingLLM to a build that includes commit 7aaa4b3 or later, which enforces flexUserRoleValid on the export endpoint.
Audit the user table in your AnythingLLM instance and remove or downgrade any unexpected accounts.
Rotate credentials, API keys, and any secrets stored in AnythingLLM workspaces, because prior exports may have exposed them.

Patch Information

The vendor fix is available in the upstream repository at GitHub Commit 7aaa4b3. The commit modifies server/endpoints/system.js so that the /system/data-export handler runs behind both validatedRequest and flexUserRoleValid. Additional context is available in the Huntr Bounty Summary.

Workarounds

If patching is not immediately possible, block /system/data-export and /system/data-exports/ at the reverse proxy for all source IPs except trusted administrator hosts.
Restrict AnythingLLM to single-tenant use until the upgrade is deployed, avoiding the provisioning of default-role accounts.
Periodically purge the storage/exports/ directory and alert on any unexpected files appearing there.

bash

# Example nginx snippet restricting export endpoints to an admin subnet
location ~ ^/system/data-exports?(/|$) {
    allow 10.0.10.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://anythingllm_upstream;
}