CVE-2024-0798 — Privilege Escalation in mintplex-labs/anything-llm
A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restr…
Published: 2024-02-25 · CVSS: 8.1 · CVSS 3.0
A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this vulnerability by sending a crafted DELETE request to the /api/system/remove-document endpoint. This vulnerability is due to improper access control checks, enabling unauthorized document deletion and potentially leading to loss of data integrity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7