CVE-2024-3283

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2	Patch
https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2	Exploit Third Party Advisory
https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2	Patch
https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

09 Jul 2025, 19:49

Type	Values Removed	Values Added
First Time		Mintplexlabs Mintplexlabs anythingllm
References	~~() https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 -~~	() https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - Patch
References	~~() https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2 -~~	() https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:mintplexlabs:anythingllm::::::::

Information

Published : 2024-04-10 17:15

Updated : 2025-07-09 19:49

NVD link : CVE-2024-3283

Mitre link : CVE-2024-3283

CVE.ORG link : CVE-2024-3283

JSON object : View

Products Affected

mintplexlabs

anythingllm

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2024-3283", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-04-10T17:15:56.600", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation."}, {"lang": "es", "value": "Una vulnerabilidad en mintplex-labs/anything-llm permite a los usuarios con funciones de administrador escalar sus privilegios a funciones de administrador a trav\u00e9s de un problema de asignaci\u00f3n masiva. El endpoint de la API '/admin/system-preferences' autoriza incorrectamente a los usuarios de nivel de administrador a modificar la variable del sistema 'multi_user_mode', lo que les permite acceder al endpoint '/api/system/enable-multi-user' y crear un nuevo usuario administrador. Este problema se produce cuando el endpoint acepta un objeto JSON completo en el cuerpo de la solicitud sin la validaci\u00f3n adecuada de los campos modificables, lo que lleva a la modificaci\u00f3n no autorizada de la configuraci\u00f3n del sistema y la posterior escalada de privilegios."}], "lastModified": "2025-07-09T19:49:06.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D667E32-5A5C-479C-BB81-47F3BCA38C13", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}