CVE-2026-72917

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72917", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-10T17:57:26.144Z", "datePublished": "2026-08-10T21:35:33.872Z", "dateUpdated": "2026-08-12T22:14:18.603Z"}, "containers": {"cna": {"title": "AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization", "problemTypes": [{"descriptions": [{"cweId": "CWE-180", "lang": "en", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56"}, {"name": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14", "tags": ["x_refsource_MISC"], "url": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14"}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"version": "Affected versions >= 1.0.0, <= 1.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:35:33.872Z"}, "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account."}], "source": {"advisory": "GHSA-vv8w-wg6r-hq56", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T22:07:58.644902Z", "id": "CVE-2026-72917", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:14:18.603Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T22:07:58.644902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:08:00.032Z"}}], "cna": {"title": "AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization", "source": {"advisory": "GHSA-vv8w-wg6r-hq56", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"status": "affected", "version": "Affected versions >= 1.0.0, <= 1.15.0"}]}], "references": [{"url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56", "name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14", "name": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-180", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:35:33.872Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72917", "state": "PUBLISHED", "dateUpdated": "2026-08-12T22:14:18.603Z", "dateReserved": "2026-08-10T17:57:26.144Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T21:35:33.872Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "anything-llm", "vendor": "Mintplex-Labs", "versions": [{"status": "affected", "version": "Affected versions >= 1.0.0, <= 1.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account."}, {"lang": "es", "value": "AnythingLLM es una aplicaci\u00f3n que convierte fragmentos de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. De 1.0.0 a 1.15.0, el flujo de recuperaci\u00f3n de cuenta no autenticado de AnythingLLM en server/utils/PasswordRecovery/index.js usa recoverAccount() para desduplicar los valores brutos de recoveryCodes antes de recortarlos, de modo que un c\u00f3digo v\u00e1lido enviado dos veces con espacios en blanco circundantes diferentes puede satisfacer la verificaci\u00f3n de dos c\u00f3digos. Cada valor normalizado tambi\u00e9n puede coincidir con el mismo hash almacenado en lugar de consumir un hash distinto. Un atacante que conoce el nombre de usuario objetivo y un c\u00f3digo de recuperaci\u00f3n puede llamar a POST /api/system/recover-account en modo multiusuario, recibir un token de restablecimiento de contrase\u00f1a y usar POST /api/system/reset-password para tomar el control de la cuenta, incluida una cuenta de administrador."}], "id": "CVE-2026-72917", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72917", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T22:07:58.644902Z", "version": "2.0.3"}}]}, "published": "2026-08-10T22:17:10.660", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14"}, {"source": "security-advisories@github.com", "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r-hq56"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-180"}, {"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.15.0]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "anything-llm", "source": "cna", "vendor": "Mintplex-Labs"}, "product": "anything-llm", "vendor": "mintplexlabs"}], "created": "2026-08-10T23:45:04.643168+00:00", "updated": "2026-08-11T02:15:03.786183+00:00", "vendors": ["mintplexlabs", "mintplexlabs$PRODUCT$anything-llm"]}