CVE-2024-3029

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.

• CWE-20

• https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073Patch
• https://huntr.com/bounties/7189a7a0-9830-459d-b853-bdc2559999a0Exploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073Patch
• https://huntr.com/bounties/7189a7a0-9830-459d-b853-bdc2559999a0Exploit, Third Party Advisory

Published

Apr 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30284Acrobat Reader versions 20.005.30574, 24.002.20736 and earli…7.8
• CVE-2024-30285Audition versions 24.2, 23.6.4 and earlier are affected by a…5.5
• CVE-2024-30286Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer:…5.5
• CVE-2024-30287Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer:…5.5
• CVE-2024-30288Adobe Framemaker versions 2020.5, 2022.3 and earlier are aff…7.8
• CVE-2024-30289Adobe Framemaker versions 2020.5, 2022.3 and earlier are aff…7.8
• CVE-2024-30290Adobe Framemaker versions 2020.5, 2022.3 and earlier are aff…7.8
• CVE-2024-30291Adobe Framemaker versions 2020.5, 2022.3 and earlier are aff…7.8
• CVE-2024-30292Adobe Framemaker versions 2020.5, 2022.3 and earlier are aff…7.8
• CVE-2024-30293Animate versions 24.0.2, 23.0.5 and earlier are affected by …7.8
• CVE-2024-30294Animate versions 24.0.2, 23.0.5 and earlier are affected by …7.8
• CVE-2024-30295Animate versions 24.0.2, 23.0.5 and earlier are affected by …7.8