{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-04T17:35:38.029","vulnerabilities":[{"cve":{"id":"CVE-2026-32717","sourceIdentifier":"security-advisories@github.com","published":"2026-03-16T14:19:42.653","lastModified":"2026-03-16T20:31:45.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API key path. If a user already has a valid brx-... browser extension API key, that key continues to work after suspension. As a result, a suspended user can still access browser extension endpoints, read reachable workspace metadata, and continue upload or embed operations even though normal authenticated requests are rejected."},{"lang":"es","value":"AnythingLLM es una aplicación que convierte piezas de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. En 1.11.1 y anteriores, en modo multiusuario, AnythingLLM bloquea a los usuarios suspendidos en la ruta de sesión normal respaldada por JWT, pero no los bloquea en la ruta de clave API de la extensión del navegador. Si un usuario ya tiene una clave API de extensión del navegador brx-... válida, esa clave sigue funcionando después de la suspensión. Como resultado, un usuario suspendido aún puede acceder a puntos finales de la extensión del navegador, leer metadatos de espacios de trabajo accesibles y continuar con las operaciones de carga o incrustación a pesar de que las solicitudes autenticadas normales son rechazadas."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*","versionEndIncluding":"1.11.1","matchCriteriaId":"384FD8C3-E046-493C-9996-8E3042229081"}]}]}],"references":[{"url":"https://github.com/Mintplex-Labs/anything-llm/commit/a207449095158f28c7e16acf113356b336c87803","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}