CVE-2026-32715 AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences

Low 3.8 Published 13 Mar 2026 Updated 16 Mar 2026

A manager can bypass admin restrictions to read database credentials and modify global settings via inconsistent endpoint permissions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32715?

CVE-2026-32715 is a low-severity missing authorization vulnerability in Mintplexlabs Anythingllm, published on 13 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.

Weakness: CWE-863

Which versions are affected by CVE-2026-32715?

It affects 1 product.

Products include Mintplexlabs Anythingllm.

How do I fix CVE-2026-32715?

No fix has been published for CVE-2026-32715 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-32715 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32715 exists.

All Mintplexlabs Anythingllm vulnerabilities

Sources

Also known as GHSA-wfq3-65gm-3g2p.