CVE-2024-0795

HIGH

AnythingLLM < 1.0.0 - Authenticated Privilege Escalation via User Creation

Title source: llm
STIX 2.1

Description

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0095
EPSS Percentile 56.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (1)
mintplexlabs/anythingllm < 1.0.0
Published Mar 02, 2024
Tracked Since Feb 18, 2026