CVE-2026-32717 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys

Low 2.7 Published 13 Mar 2026 Updated 16 Mar 2026

Suspended users in multi-user mode can bypass access controls via browser extension API keys to read metadata and perform uploads.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32717?

CVE-2026-32717 is a low-severity authentication bypass vulnerability in Mintplexlabs Anythingllm, published on 13 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API key path. If a user already has a valid brx-... browser extension API key, that key continues to work after suspension. As a result, a suspended user can still access browser extension endpoints, read reachable workspace metadata, and continue upload or embed operations even though normal authenticated requests are rejected.

Weakness: CWE-863

Which versions are affected by CVE-2026-32717?

It affects 1 product.

Products include Mintplexlabs Anythingllm.

How do I fix CVE-2026-32717?

No fix has been published for CVE-2026-32717 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-32717 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32717 exists.

All Mintplexlabs Anythingllm vulnerabilities

Sources

Also known as GHSA-7754-8jcc-2rg3.