CVE-2024-3283

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation.

• CWE-915

• https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2Patch
• https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2Exploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2Patch
• https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2Exploit, Third Party Advisory

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32824Missing Authorization vulnerability in Evergreen Content Pos…8.8
• CVE-2024-32825Insertion of Sensitive Information Into Sent Data vulnerabil…7.5
• CVE-2024-32826Missing Authorization vulnerability in Vektor,Inc. VK Block …5.3
• CVE-2024-32827Authentication Bypass by Spoofing vulnerability in RafflePre…5.3
• CVE-2024-32828Missing Authorization vulnerability in Octolize Flexible Shi…4.3
• CVE-2024-32829Missing Authorization vulnerability in Supsystic Data Tables…4.3
• CVE-2024-32830Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2024-32831Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2024-32832Missing Authorization vulnerability in Hamid Alinia Login wi…9.8
• CVE-2024-32833Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2024-32834Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2024-32835Deserialization of Untrusted Data vulnerability in WebToffee…5.4