CVE-2026-21484

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21484", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T14:34:16.005Z", "datePublished": "2026-01-03T01:21:39.386Z", "dateUpdated": "2026-01-05T20:36:58.168Z"}, "containers": {"cna": {"title": "AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery", "problemTypes": [{"descriptions": [{"cweId": "CWE-203", "lang": "en", "description": "CWE-203: Observable Discrepancy", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-204", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch"}, {"name": "https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313", "tags": ["x_refsource_MISC"], "url": "https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313"}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"version": "< e287fab56089cf8fcea9ba579a3ecdeca0daa313", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-03T01:21:39.386Z"}, "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue."}], "source": {"advisory": "GHSA-47vr-w3vm-69ch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-05T20:32:28.995295Z", "id": "CVE-2026-21484", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:36:58.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21484", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:32:28.995295Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:32:29.681Z"}}], "cna": {"title": "AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery", "source": {"advisory": "GHSA-47vr-w3vm-69ch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"status": "affected", "version": "< e287fab56089cf8fcea9ba579a3ecdeca0daa313"}]}], "references": [{"url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch", "name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313", "name": "https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-203", "description": "CWE-203: Observable Discrepancy"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-03T01:21:39.386Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21484", "state": "PUBLISHED", "dateUpdated": "2026-01-05T20:36:58.168Z", "dateReserved": "2025-12-29T14:34:16.005Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-03T01:21:39.386Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "anything-llm", "vendor": "Mintplex-Labs", "versions": [{"status": "affected", "version": "< e287fab56089cf8fcea9ba579a3ecdeca0daa313"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DEA04F2-1EE6-4943-B989-76CB56A33BC2", "versionEndExcluding": "1.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue."}, {"lang": "es", "value": "AnythingLLM es una aplicaci\u00f3n que convierte fragmentos de contenido en contexto que cualquier LLM puede usar como referencias al chatear. Antes del commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, el endpoint de recuperaci\u00f3n de contrase\u00f1a devuelve diferentes mensajes de error dependiendo de si un nombre de usuario existe, lo que permite la enumeraci\u00f3n de nombres de usuario. El commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 soluciona este problema."}], "id": "CVE-2026-21484", "lastModified": "2026-06-17T10:18:42.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21484", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-05T20:32:28.995295Z", "version": "2.0.3"}}]}, "published": "2026-01-03T02:15:41.553", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}, {"lang": "en", "value": "CWE-204"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T20:11:57.968454+00:00", "value": {"mitigation_remediation": ["Update AnythingLLM to the patched version that includes commit e287fab56089cf8fcea9ba579a3ecdeca0daa313.", "If a patch cannot be applied immediately, temporarily disable or restrict the password recovery endpoint and enforce uniform error messages for all usernames.", "Implement rate limiting or CAPTCHA on the password recovery form and monitor logs for abnormal enumeration activity."], "summary": {"action": "Apply Patch", "impact": "Username Enumeration via Password Recovery"}, "threat_synthesis": {"affected_systems": "Mintplex-Labs AnythingLLM versions before commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 are affected.", "description_and_impact": "AnythingLLM exposes an enumeration flaw in its password recovery endpoint: error messages vary depending on whether the supplied username exists, allowing an attacker to discover valid accounts. The vulnerability is an information disclosure that can facilitate targeted phishing or credential stuffing attempts. It is classified under CWE-203 and CWE-204, indicating exposure through error handling and logging.", "risk_and_exploitability": "The CVSS score is 5.3, giving it a medium severity. EPSS is 1%, indicating a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated password recovery requests to the web endpoint and observing the differing responses, which provides knowledge of account existence without any further privileges."}}}}, "created": "2026-01-05T10:13:38.849021+00:00", "updated": "2026-04-18T20:15:09.558310+00:00", "vendors": ["mintplexlabs", "mintplexlabs$PRODUCT$anything-llm"]}