CVE-2026-55611

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 until 1.14.1, userId/workspaceId scoping to the parsed-files read/delete paths was added. However, the POST /api/workspace/:slug/embed-parsed-file/:fileId flow still deletes the target file by primary key only, with no ownership check, inside two finally{} blocks that run even when the ownership-checked read fails. As a result a manager or admin (multi-user mode) can delete any other user's parsed file in any workspace — including workspaces they are not a member of — by enumerating integer fileIds. The server even returns "File not found" while still deleting the file. This vulnerability is fixed in 1.14.1.

• CWE-639

• https://github.com/Mintplex-Labs/anything-llm/commit/34a42a33eaafe78b1e4020995ce8e9fd34d26c65
• https://github.com/Mintplex-Labs/anything-llm/commit/683fe3dfdc74b6d94c445a25bb0f2f218665a4c6
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-r872-gr59-vf5w

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55605DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…5.3
• CVE-2026-55607Claude Code is an agentic coding tool. From 2.1.38 until 2.…8.8
• CVE-2026-55608n8n-MCP is an MCP server that provides AI assistants access …5.4
• CVE-2026-55609sublinear-time-solver is a Rust and WebAssembly library for …7.1
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55610InvoiceShelf is an open-source web & mobile app that helps t…8.7
• CVE-2026-55615Langroid is a framework for building large-language-model-po…9.2
• CVE-2026-55616Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-55617Hydro is a next-generation high-performance online judge pla…6.9
• CVE-2026-55618eml_parser serves as a python module for parsing eml files a…6.5
• CVE-2026-55619eml_parser serves as a python module for parsing eml files a…5.3
• CVE-2026-5562A vulnerability was identified in provectus kafka-ui up to 0…9.8