CVE-2024-10109 — Incorrect Authorization in mintplex-labs/anything-llm
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". …
Published: 2025-03-20 · CVSS: 8.3 · CVSS 3.0
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7