CVE-2026-32891

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32891", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T21:03:44.422Z", "datePublished": "2026-03-20T02:38:43.329Z", "dateUpdated": "2026-03-20T14:36:21.045Z"}, "containers": {"cna": {"title": "Anchorr Privilege Escalation: Jellyseerr User \u2192 Anchorr Admin via Stored XSS", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-212", "lang": "en", "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-311", "lang": "en", "description": "CWE-311: Missing Encryption of Sensitive Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g"}, {"name": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2"}], "affected": [{"vendor": "openVESSL", "product": "Anchorr", "versions": [{"version": "< 1.4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T02:38:43.329Z"}, "descriptions": [{"lang": "en", "value": "Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2."}], "source": {"advisory": "GHSA-6mg4-788h-7g9g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T14:36:17.232530Z", "id": "CVE-2026-32891", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:36:21.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32891", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-20T14:36:17.232530Z"}}}], "references": [{"url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:36:06.498Z"}}], "cna": {"title": "Anchorr Privilege Escalation: Jellyseerr User \u2192 Anchorr Admin via Stored XSS", "source": {"advisory": "GHSA-6mg4-788h-7g9g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openVESSL", "product": "Anchorr", "versions": [{"status": "affected", "version": "< 1.4.2"}]}], "references": [{"url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "name": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2", "name": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-212", "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311: Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T02:38:43.329Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32891", "state": "PUBLISHED", "dateUpdated": "2026-03-20T14:36:21.045Z", "dateReserved": "2026-03-16T21:03:44.422Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T02:38:43.329Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Anchorr", "vendor": "openVESSL", "versions": [{"status": "affected", "version": "< 1.4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:*", "matchCriteriaId": "584CDEBF-7E62-4732-A6FD-64B3384C3834", "versionEndIncluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2."}, {"lang": "es", "value": "Anchorr es un bot de Discord para solicitar pel\u00edculas y programas de TV y recibir notificaciones cuando se a\u00f1aden elementos a un servidor de medios. Las versiones 1.4.1 e inferiores contienen una vulnerabilidad XSS almacenada en el selector de usuario de Jellyseerr. Jellyseerr permite a cualquier titular de cuenta ejecutar JavaScript arbitrario en la sesi\u00f3n del navegador del administrador de Anchorr. El script inyectado llama al endpoint autenticado /api/config - que devuelve la configuraci\u00f3n completa de la aplicaci\u00f3n en texto plano. Esto permite al atacante forjar un token de sesi\u00f3n de Anchorr v\u00e1lido y obtener acceso de administrador completo al panel de control sin conocimiento de la contrase\u00f1a de administrador. La misma respuesta tambi\u00e9n expone las claves API y los tokens para cada servicio integrado, lo que resulta en la toma de control simult\u00e1nea de la cuenta del servidor de medios Jellyfin (a trav\u00e9s de JELLYFIN_API_KEY), del gestor de solicitudes Jellyseerr (a trav\u00e9s de JELLYSEERR_API_KEY), y del bot de Discord (a trav\u00e9s de DISCORD_TOKEN). Este problema ha sido solucionado en la versi\u00f3n 1.4.2."}], "id": "CVE-2026-32891", "lastModified": "2026-06-17T10:36:31.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32891", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T14:36:17.232530Z", "version": "2.0.3"}}]}, "published": "2026-03-20T03:16:00.240", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-212"}, {"lang": "en", "value": "CWE-311"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Anchorr", "source": "cna", "vendor": "openVESSL"}, "product": "anchorr", "vendor": "openvessl"}], "analysis": {"en": {"generated_at": "2026-03-27T17:28:53.561540+00:00", "value": {"mitigation_remediation": ["Upgrade Anchorr to version 1.4.2 or later.", "Verify that the Jellyseerr user selector no longer renders unsanitized input.", "If an upgrade is not immediately possible, limit the exposure of the /api/config endpoint by restricting access to trusted users or by removing it temporarily.", "Monitor Anchorr logs for unusual configuration requests and test the system for XSS markers."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is Anchorr, produced by openVESSL. Versions 1.4.1 and earlier contain the vulnerability. The fix was released in Anchorr 1.4.2, which removes the possibility to inject scripts into the Jellyseerr selector. Users running any version before 1.4.2 are at risk.", "description_and_impact": "Anchorr, a Discord bot that manages media requests, has a stored cross\u2011site scripting flaw in its Jellyseerr user selector. The flaw lets any authenticated user inject JavaScript that executes in the browser session of an Anchorr administrator. The malicious script calls the /api/config endpoint, revealing the full application configuration, API keys, and tokens in plaintext. An attacker can use this data to forge an admin session token and take over the Anchorr dashboard, and simultaneously compromise the linked Jellyfin media server, Jellyseerr request manager, and Discord bot.", "risk_and_exploitability": "The CVSS score of 9.1 signals a high\u2011severity issue. However, the exploit probability is very low, with an EPSS of less than 1%, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers need only a normal account on an Anchorr instance to inject the payload; no admin credentials are required. The impact is total loss of confidentiality, integrity, and availability for the entire platform and integrated services."}}}}, "created": "2026-03-20T08:53:01.176271+00:00", "updated": "2026-03-27T20:26:51.285187+00:00", "vendors": ["openvessl", "openvessl$PRODUCT$anchorr"]}