CVE-2026-32891 Details
Description
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.
A stored cross-site scripting vulnerability has been identified in the Anchorr Discord bot, specifically in versions through 1.4.1. The issue arises within the Jellyseerr user selector, where unescaped display names can be used to inject arbitrary JavaScript. This injected script executes in the context of the Anchorr admin's browser session, calling the authenticated /api/config endpoint, which exposes the full application configuration, including sensitive tokens and API keys. This vulnerability enables an attacker to forge a valid Anchorr session token, gaining full admin access to the dashboard without needing the admin password. The exposed configuration also includes API keys for integrated services, allowing for account takeovers on Jellyfin, Jellyseerr, and Discord.
Users are advised to update to Anchorr version 1.4.2, which addresses the stored XSS vulnerability by sanitizing user input and implementing additional security measures.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g | CISA-ADP | Vendor Advisory |
| https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2 | [email protected] | Release Notes |
| https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | [email protected] |
| CWE-311 | Missing Encryption of Sensitive Data | [email protected] |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openvessl anchorr | <= 1.4.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |