CVE-2026-55611 Details
Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 until 1.14.1, userId/workspaceId scoping to the parsed-files read/delete paths was added. However, the POST /api/workspace/:slug/embed-parsed-file/:fileId flow still deletes the target file by primary key only, with no ownership check, inside two finally{} blocks that run even when the ownership-checked read fails. As a result a manager or admin (multi-user mode) can delete any other user's parsed file in any workspace — including workspaces they are not a member of — by enumerating integer fileIds. The server even returns "File not found" while still deleting the file. This vulnerability is fixed in 1.14.1.
A vulnerability in AnythingLLM versions 1.11.1 prior to 1.14.1 allows for unauthorized deletion of parsed files across different workspaces. The issue arises because the 'embed-parsed-file' API route deletes files by primary key without checking ownership, enabling managers or admins to remove files belonging to other users, even in workspaces they do not belong to. This is achieved by manipulating file IDs, leading to cross-tenant data loss.
Users can update to AnythingLLM version 1.14.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Mintplex-Labs/anything-llm/commit/34a42a33eaafe78b1e4020995ce8e9fd34d26c65 | [email protected] | Source CodeVendor |
| https://github.com/Mintplex-Labs/anything-llm/commit/683fe3dfdc74b6d94c445a25bb0f2f218665a4c6 | [email protected] | Source CodeVendor |
| https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mintplex-Labs AnythingLLM | >= 1.11.1, <= 1.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |