CVE-2024-0795: Mintplexlabs AnythingLLM Privilege Escalation

CVE-2024-0795 Overview

CVE-2024-0795 is a broken access control vulnerability [CWE-284] in Mintplex Labs AnythingLLM. The application fails to enforce backend authorization checks on user creation endpoints. An authenticated attacker holding the manager role can create a new user account with the admin role. The attacker then authenticates as the new admin account to gain elevated privileges on the instance.

The vulnerability affects the frontend and backend routing model used before commit 9a237db3d1f66cdbcf5079599258f5fb251c5564. Mintplex Labs addressed the issue with a total permission overhaul that reroutes privileged operations through admin-only guards.

Critical Impact
A manager role account can promote itself to admin, taking full control of an AnythingLLM instance, including workspaces, API keys, and connected LLM providers.

Affected Products

Mintplex Labs AnythingLLM (versions prior to the fix in commit 9a237db3)
Self-hosted AnythingLLM deployments exposing the admin or manager interface
Docker and desktop AnythingLLM builds running the affected frontend and backend

Discovery Timeline

2024-03-02 - CVE-2024-0795 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0795

Vulnerability Analysis

The flaw is a broken access control issue in AnythingLLM's role model. Frontend routes and backend endpoints for privileged operations, including user administration and API key management, were gated only by a ManagerRoute guard rather than an AdminRoute guard. Backend handlers did not independently verify that the requesting user held the admin role before accepting user-creation requests.

An authenticated user with the manager role can issue a request to the user-creation endpoint and set the new user's role to admin. Because the backend trusts the role field supplied by any authenticated user cleared by the manager gate, the new admin account is created. The attacker authenticates as that account and gains full administrative control.

The attack requires network access to the instance and prior possession of manager credentials. Impact spans confidentiality, integrity, and availability of the AnythingLLM workspace, including access to embedded documents, connected model providers, and stored API keys.

Root Cause

The root cause is missing server-side authorization checks combined with over-permissive frontend route guards. Privileged routes such as /settings/api-keys and the user-management endpoints were assigned to ManagerRoute. The backend did not enforce a role hierarchy that restricts admin creation to admins.

Attack Vector

An attacker with valid manager credentials submits an authenticated HTTP request to the user-creation API and sets the role field to admin. The attacker then logs in as the new admin user.

text

               />
               <Route
                 path="/settings/api-keys"
-                element={<ManagerRoute Component={GeneralApiKeys} />}
+                element={<AdminRoute Component={GeneralApiKeys} />}
               />
               <Route
                 path="/settings/workspace-chats"

Source: Mintplex Labs commit 9a237db3

The patch replaces ManagerRoute with AdminRoute for sensitive settings and adds authenticated baseHeaders() to system fetches such as profile picture retrieval:

javascript

     return await fetch(`${API_BASE}/system/pfp/${id}`, {
       method: "GET",
       cache: "no-cache",
+      headers: baseHeaders(),
     })
       .then((res) => {
         if (res.ok && res.status !== 204) return res.blob();

Source: Mintplex Labs commit 9a237db3

Detection Methods for CVE-2024-0795

Indicators of Compromise

Creation of new users with the admin role by accounts that previously held only the manager role.
Unexpected logins from newly created admin accounts followed by changes to API keys or LLM provider credentials.
Modifications to workspace permissions, invitations, or embed configurations shortly after a manager session.

Detection Strategies

Audit the AnythingLLM users table for admin accounts created after a manager session and compare against known administrator inventory.
Review application logs for POST requests to user-creation endpoints originating from manager-tier session tokens.
Correlate role-change events with source IP, user agent, and session identifiers to detect anomalous privilege promotion.

Monitoring Recommendations

Forward AnythingLLM application logs and reverse proxy access logs to a central log store and alert on admin role assignments.
Alert on any successful authentication by an account created within the last 24 hours that immediately performs administrative actions.
Monitor outbound traffic from the AnythingLLM host for exfiltration of API keys or embedded document content after suspected privilege escalation.

How to Mitigate CVE-2024-0795

Immediate Actions Required

Upgrade AnythingLLM to a build that includes commit 9a237db3d1f66cdbcf5079599258f5fb251c5564 or later.
Enumerate all admin accounts and remove any that cannot be attributed to an authorized administrator.
Rotate all AnythingLLM API keys, LLM provider credentials, and manager and admin passwords after patching.

Patch Information

Mintplex Labs fixed the issue in the permission overhaul commit 9a237db3. The patch reassigns privileged frontend routes to AdminRoute and enforces admin-only access for user management and API key settings. Additional context is available in the Huntr bounty report.

Workarounds

Restrict the manager role to trusted users only until the patched version is deployed.
Place the AnythingLLM management interface behind a VPN or IP allowlist to limit exposure of authenticated endpoints.
Disable multi-user mode temporarily if manager accounts are not required for operations.

bash

# Pull the patched AnythingLLM container image and restart the service
docker pull mintplexlabs/anythingllm:latest
docker stop anythingllm && docker rm anythingllm
docker run -d --name anythingllm \
  -p 3001:3001 \
  -v anythingllm_storage:/app/server/storage \
  mintplexlabs/anythingllm:latest