CVE-2026-47713 in anything-llm
Summary
by MITRE • 05/29/2026
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile device token created in single-user mode can survive single-user -> multi-user migration even when the device record has userId = null. In multi-user mode, that stale token is still accepted by the mobile authentication middleware. Because no user is attached to the request, downstream mobile handlers fall back to unscoped data-access branches and return workspaces and workspace content without per-user filtering. This permits a pre-migration mobile token to enumerate a workspace assigned only to another user and retrieve victim-owned thread metadata and chat content in multi-user mode. This vulnerability is fixed in 1.13.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists in AnythingLLM applications prior to version 1.13.0 and represents a critical access control flaw that undermines user isolation in multi-user environments. The issue stems from improper token handling during mode transitions from single-user to multi-user configurations, creating a persistent security gap that allows unauthorized data access. When a mobile device token is created in single-user mode, the system fails to properly invalidate or revalidate this token during the migration process, even when the device record contains a null userId field. This architectural oversight creates a scenario where stale authentication credentials can persist beyond their intended scope, fundamentally compromising the security model of the application's user management system.
The technical implementation flaw manifests through the mobile authentication middleware's handling of device tokens that have not been properly migrated or invalidated during the transition. When the application switches from single-user to multi-user mode, the middleware continues to accept tokens that should have been invalidated, creating a pathway for unauthorized access. The vulnerability specifically exploits the absence of proper user context validation in the authentication flow, allowing requests to proceed without proper user association. This lack of user binding causes downstream handlers to fall back to unscoped data access patterns, which bypass normal per-user filtering mechanisms that should protect workspace content from unauthorized access.
The operational impact of this vulnerability is severe and directly affects user privacy and data isolation within multi-user environments. An attacker with access to a pre-migration mobile token can enumerate workspaces that are exclusively assigned to other users, gaining access to thread metadata and chat content that should remain private to the legitimate user. This represents a complete breakdown of the application's data access controls, enabling information disclosure and potential data exfiltration. The vulnerability essentially allows one user to access another user's workspace content without proper authorization, creating a significant risk for environments where sensitive information is processed through the LLM application. The scope of impact extends beyond simple data enumeration to potentially expose confidential conversations and workspace configurations that should be restricted to individual users.
This vulnerability aligns with CWE-285, which addresses improper authorization in authentication mechanisms, and demonstrates characteristics of CWE-345, concerning insufficient verification of data sources. The issue also maps to ATT&CK technique T1566, which covers credential access through the exploitation of authentication bypasses, and T1078, which deals with valid accounts used for persistence and privilege escalation. The security flaw represents a failure in proper session management and token lifecycle handling, where the application does not adequately validate or invalidate authentication tokens during mode transitions. The vulnerability specifically targets the application's multi-user access control model, where proper user context validation should prevent cross-user data access but fails to function correctly due to the stale token handling mechanism.
The mitigation strategy involves implementing proper token invalidation during mode transitions from single-user to multi-user configurations, ensuring that device tokens created in single-user mode are properly invalidated when the application enters multi-user mode. This requires updating the authentication middleware to validate token scope and user context during authentication, preventing stale tokens from being accepted in multi-user environments. The fix in version 1.13.0 addresses the root cause by implementing proper token lifecycle management and ensuring that device records with null userId fields are properly handled during migration processes. Additionally, implementing proper session validation and user context binding in the authentication flow will prevent the fallback to unscoped data access patterns that enable the unauthorized enumeration of workspace content. Organizations should also consider implementing regular token rotation policies and monitoring for unauthorized access patterns to detect potential exploitation of similar vulnerabilities.