CVE-2024-10109CWE-863

Incorrect Authorization in mintplex-labs/anything-llm

High · published March 20, 2025

CVSS v3.0
8.3
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

The record
Technical detail
CVSS v3.0
8.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Incorrect Authorization in mintplex-labs/anything-llm
    cvelistv5