CVE-2026-72917

{
  "id": "CVE-2026-72917",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T22:17:10.660",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account."
    },
    {
      "lang": "es",
      "value": "AnythingLLM es una aplicación que convierte fragmentos de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. De 1.0.0 a 1.15.0, el flujo de recuperación de cuenta no autenticado de AnythingLLM en server/utils/PasswordRecovery/index.js usa recoverAccount() para desduplicar los valores brutos de recoveryCodes antes de recortarlos, de modo que un código válido enviado dos veces con espacios en blanco circundantes diferentes puede satisfacer la verificación de dos códigos. Cada valor normalizado también puede coincidir con el mismo hash almacenado en lugar de consumir un hash distinto. Un atacante que conoce el nombre de usuario objetivo y un código de recuperación puede llamar a POST /api/system/recover-account en modo multiusuario, recibir un token de restablecimiento de contraseña y usar POST /api/system/reset-password para tomar el control de la cuenta, incluida una cuenta de administrador."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mintplex-Labs",
          "product": "anything-llm",
          "versions": [
            {
              "version": "Affected versions >= 1.0.0, <= 1.15.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T22:07:58.644902Z",
          "id": "CVE-2026-72917",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-180"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56",
      "source": "[email protected]"
    }
  ]
}