CVE-2024-13060

4.3 mediumEPSS 0.5%

Medium (4.3) in mintplexlabs anythingllm docker. EPSS 0.5% chance of exploitation in the next 30 days.

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mintplexlabs:anythingllm_docker

References

https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45a
https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f
https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f

Check your stack JSON