CVE-2026-32715: Mintplexlabs AnythingLLM Info Disclosure

CVE-2026-32715 Overview

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. A broken access control vulnerability exists in versions 1.11.1 and earlier where two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.

Critical Impact

Authenticated users with manager privileges can bypass access controls to read sensitive SQL database credentials in plaintext and modify admin-only system settings, potentially compromising the entire application's security posture.

Affected Products

• Mintplexlabs AnythingLLM versions 1.11.1 and earlier

Discovery Timeline

• March 16, 2026 - CVE-2026-32715 published to NVD
• March 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32715

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), representing a failure to properly enforce role-based access controls across all API endpoints. The core issue stems from an inconsistency in how the application enforces authorization checks between the frontend user interface and the backend API endpoints.

In AnythingLLM, the system-preferences endpoints were configured to permit access to users with the manager role, while the frontend components and other related API surfaces correctly restricted these same settings to administrators only. This discrepancy creates a privilege escalation path where a manager-level user can bypass the intended access restrictions by directly invoking the vulnerable API endpoints.

The impact includes exposure of plaintext SQL database credentials, which could enable further attacks against the underlying database infrastructure. Additionally, the ability to modify admin-only global settings such as the default system prompt and Community Hub API key could allow attackers to inject malicious content or compromise integrations with external services.

Root Cause

The root cause of this vulnerability lies in incomplete implementation of role-based access control (RBAC) across the AnythingLLM codebase. The developers implemented proper authorization checks in most areas of the application but failed to apply consistent restrictions to the generic system-preferences endpoints in server/endpoints/admin.js. This oversight allowed manager-role users to access functionality that should have been exclusively available to administrators.

Attack Vector

An authenticated user with manager-level privileges can exploit this vulnerability by making direct API calls to the system-preferences endpoints. Since the frontend properly hides these options from managers, the attack requires direct interaction with the API, bypassing the user interface entirely. The attacker can:

1. Query the system-preferences endpoint to retrieve sensitive configuration data including plaintext SQL database credentials
2. Modify global application settings that should be restricted to administrators
3. Potentially escalate access by using exposed credentials to directly access the database

The security patch implemented the following changes to align API access controls with the frontend restrictions:

     [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],
     async (request, response) => {
       try {
+        const user = await userFromSession(request, response);
         const requestedSettings = {};
         const labels = request.query.labels?.split(",") || [];
         const needEmbedder = [

Source: GitHub Commit Details

The fix adds proper user session validation to ensure role-appropriate access to sensitive settings.

Detection Methods for CVE-2026-32715

Indicators of Compromise

• Unexpected API calls to system-preferences endpoints from manager-role user accounts
• Access logs showing manager users retrieving database configuration settings
• Modifications to global system prompts or Community Hub API keys without corresponding admin activity
• Anomalous database connection attempts from unexpected sources using exposed credentials

Detection Strategies

• Monitor API endpoint access logs for calls to system-preferences endpoints from non-admin users
• Implement alerting on configuration changes to critical settings such as default system prompts and API keys
• Audit manager-role account activity for patterns consistent with privilege escalation attempts
• Deploy API gateway rules to log and alert on direct API access bypassing the frontend interface

Monitoring Recommendations

• Enable verbose logging for all authentication and authorization events in AnythingLLM
• Configure SIEM rules to correlate API access patterns with user role assignments
• Implement real-time alerting for any access to database credential settings
• Regularly review access control configurations across all API endpoints for consistency

How to Mitigate CVE-2026-32715

Immediate Actions Required

• Update AnythingLLM to a version newer than 1.11.1 that includes the security fix
• Audit manager-role user activity logs for any suspicious access to system-preferences endpoints
• Rotate SQL database credentials if there is any indication they may have been exposed
• Review and regenerate Community Hub API keys if unauthorized access is suspected
• Temporarily restrict manager-role accounts until the patch is applied

Patch Information

Mintplexlabs has released a security patch addressing this authorization bypass vulnerability. The fix is available in commit 732eac6fa89f43288bbb65ecc6298ebcd96b7aeb. Organizations should update to the latest version of AnythingLLM that incorporates this patch. For detailed information, refer to the GitHub Security Advisory GHSA-wfq3-65gm-3g2p.

Workarounds

• Limit assignment of the manager role to trusted personnel until the patch is applied
• Implement network-level restrictions on API access to system-preferences endpoints
• Deploy a web application firewall (WAF) rule to block unauthorized access to sensitive configuration endpoints
• Consider temporarily demoting manager accounts to lower privilege levels until remediation is complete

# Review current manager-role users in your AnythingLLM deployment
# After patching, verify that managers can no longer access admin-only endpoints
# Test by attempting to access system-preferences as a manager user
curl -X GET "https://your-anythingllm-instance/api/system-preferences" \
  -H "Authorization: Bearer <manager_token>" \
  -H "Content-Type: application/json"
# Expected response after patch: 403 Forbidden