CVE-2024-4284

A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's `id` attribute to a value of 0. This issue affects the current version of the software, with the latest commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. By exploiting this vulnerability, an attacker, with manager or admin privileges, can render a chosen account completely inaccessible. The application's mechanism for suspending accounts does not provide a means to reverse this condition through the UI, leading to uncontrolled resource consumption. The vulnerability is introduced due to the lack of input validation and sanitization in the user modification endpoint and the middleware's token validation logic. This issue has been addressed in version 1.0.0 of the software.

• CWE-400

• https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789Patch
• https://huntr.com/bounties/a5f45596-0aef-49e0-9f7d-63f1955a1552Exploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789Patch
• https://huntr.com/bounties/a5f45596-0aef-49e0-9f7d-63f1955a1552Exploit, Third Party Advisory

Published

May 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42818A cross-site scripting (XSS) vulnerability in the Config-Cre…6.1
• CVE-2024-4282Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 depreca…9.8
• CVE-2024-4283An issue has been discovered in GitLab EE affecting all vers…6.1
• CVE-2024-42831A reflected cross-site scripting (XSS) vulnerability in Elai…6.1
• CVE-2024-42834A stored cross-site scripting (XSS) vulnerability in the Cre…5.4
• CVE-2024-42835langflow v1.0.12 was discovered to contain a remote code exe…9.8
• CVE-2024-42843Projectworlds Online Examination System v1.0 is vulnerable t…9.8
• CVE-2024-42844A SQL Injection vulnerability has been identified in EPICOR …8.1
• CVE-2024-42845An eval Injection vulnerability in the component invesalius/…8
• CVE-2024-42849An issue in Silverpeas v.6.4.2 and lower allows a remote att…6.5
• CVE-2024-4285Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-42850An issue in the password change function of Silverpeas v6.4.…9.8