CVE-2026-32717

Name: CVE-2026-32717
Creator: NVD / NIST
Published: 2026-03-16T14:19:42.653+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 2.7/10EPSS 0.23%

Last modified Jun 17, 2026

CVE-2026-32717 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API key path. EPSS estimates a 0.23% chance of exploitation in the next 30 days.

Description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API key path. If a user already has a valid brx-... browser extension API key, that key continues to work after suspension. As a result, a suspended user can still access browser extension endpoints, read reachable workspace metadata, and continue upload or embed operations even though normal authenticated requests are rejected.

Metrics

CVSS 3.1

2.7/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS Probability

0.23%

13.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-863

Affected Software

Vendor	Product	Versions
Mintplexlabs	Anythingllm	<= 1.11.1

References

https://github.com/Mintplex-Labs/anything-llm/commit/a207449095158f28c7e16acf113356b336c87803Patch
https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3Exploit, Vendor Advisory
https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3Exploit, Vendor Advisory

Timeline

Published: Mar 16, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-32717?

How severe is CVE-2026-32717?

CVE-2026-32717 has a CVSS score of 2.7/10 (LOW severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.

How do I fix CVE-2026-32717?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-32717?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST