CVE-2024-2913CWE-367

Race Condition Vulnerability in mintplex-labs/anything-llm

Medium · published May 6, 2024

CVSS v3.0
6.5
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2024-05-06T23:42Z
EPSS history
Timeline
  • 06 MAY 23:42Z
    Race Condition Vulnerability in mintplex-labs/anything-llm
    cvelistv5