CVE-2024-6842

7.5 highEPSS 36%

High (7.5) in mintplexlabs anythingllm. EPSS 36% chance of exploitation in the next 30 days.

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 36% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mintplexlabs:anythingllm

References

https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8
https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e

Check your stack JSON