CVE-2026-32890 Details
Description
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.
A stored cross-site scripting vulnerability has been identified in the Anchorr Discord bot, specifically in versions through 1.4.1. This vulnerability resides in the web dashboard's User Mapping dropdown, where Discord member display names are rendered without proper sanitization. Unprivileged Discord users can exploit this flaw to inject arbitrary JavaScript that executes in the context of the Anchorr admin's browser. By combining this with a request to the '/api/config' endpoint, which exposes sensitive credentials in plaintext, an attacker can exfiltrate all stored secrets from Anchorr, including the Discord bot token, Jellyfin and Jellyseerr API keys, JWT and webhook secrets, and bcrypt password hashes.
Users are advised to update to Anchorr version 1.4.2, which addresses this vulnerability by sanitizing user inputs, validating avatar URLs, and implementing security measures such as response headers and authentication rate limiting.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openvessl anchorr | <= 1.4.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Reanalysis | [email protected] |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |