AVID-2026-R1459

Description

Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm (CVE-2024-3101)

Details

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating ‘Multi-User Mode’. By sending a specially crafted curl request with the ‘multi_user_mode’ parameter set to false, an attacker can deactivate ‘Multi-User Mode’. This action permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access.

Reason for inclusion in AVID: The CVE describes a privilege escalation via improper input validation in mintplex-labs/anything-llm, a software component used within AI systems to manage LLM deployments. Exploiting this vulnerability allows an attacker to create an admin account without a password, compromising the AI runtime/deployment stack. This is a software supply-chain issue within AI software stacks (not hardware/firmware), affecting components used to build, deploy, or run general-purpose AI systems.

References

Affected or Relevant Artifacts

Developer: mintplex-labs
Deployer: mintplex-labs
Artifact Details:

Type	Name
System	mintplex-labs/anything-llm

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Base Score	6.7
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🔴 High
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🟢 Low

CWE

ID	Description
CWE-20	CWE-20 Improper Input Validation

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-04-10
Version: 0.3.3
AVID Entry