CVE-2026-55611

{
  "id": "CVE-2026-55611",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T18:17:19.443",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 until 1.14.1, userId/workspaceId scoping to the parsed-files read/delete paths was added. However, the POST /api/workspace/:slug/embed-parsed-file/:fileId flow still deletes the target file by primary key only, with no ownership check, inside two finally{} blocks that run even when the ownership-checked read fails. As a result a manager or admin (multi-user mode) can delete any other user's parsed file in any workspace — including workspaces they are not a member of — by enumerating integer fileIds. The server even returns \"File not found\" while still deleting the file. This vulnerability is fixed in 1.14.1."
    },
    {
      "lang": "es",
      "value": "AnythingLLM es una aplicación que convierte piezas de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. Desde la versión 1.11.1 hasta la 1.14.1, se añadió el alcance de userId/workspaceId a las rutas de lectura/eliminación de archivos analizados. Sin embargo, el flujo POST /api/workspace/:slug/embed-parsed-file/:fileId aún elimina el archivo objetivo solo por clave primaria, sin verificación de propiedad, dentro de dos bloques finally{} que se ejecutan incluso cuando la lectura con verificación de propiedad falla. Como resultado, un gerente o administrador (en modo multiusuario) puede eliminar el archivo analizado de cualquier otro usuario en cualquier espacio de trabajo -incluidos los espacios de trabajo de los que no es miembro- al enumerar los fileIds enteros. El servidor incluso devuelve ’Archivo no encontrado’ mientras sigue eliminando el archivo. Esta vulnerabilidad se corrige en la versión 1.14.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mintplex-Labs",
          "product": "anything-llm",
          "versions": [
            {
              "version": "< 1.14.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N",
          "baseScore": 0.0,
          "baseSeverity": "NONE",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 0.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T18:30:51.957851Z",
          "id": "CVE-2026-55611",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/commit/34a42a33eaafe78b1e4020995ce8e9fd34d26c65",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/commit/683fe3dfdc74b6d94c445a25bb0f2f218665a4c6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}