CVE-2026-47713: 
Homebrew 脆弱性の分析と軽減

CVE-2026-47713 is an improper authorization vulnerability in AnythingLLM (by Mintplex Labs) that allows a pre-migration mobile device token to bypass per-user workspace scoping in multi-user mode. When an AnythingLLM instance is migrated from single-user to multi-user mode, mobile device tokens created during single-user operation (with userId = null) remain valid and are accepted by the mobile authentication middleware without user-scoped filtering. This enables an attacker holding such a stale token to enumerate workspaces assigned to other users and retrieve their thread metadata and chat content. All versions prior to 1.13.0 are affected. The vulnerability was published on May 28, 2026, with a CVSS v3.1 base score of 4.3 (Medium) per NVD, though the advisory author estimated a higher severity of 8.1 (High) (GitHub Advisory).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). In single-user mode, mobile device registration does not require an associated user, resulting in device records stored with userId = null. Upon migration to multi-user mode, the validDeviceToken middleware continues to accept these orphaned tokens without verifying that a valid user is attached to the request. Downstream mobile API handlers (server/endpoints/mobile/index.js, server/models/mobileDevice.js) fall back to unscoped data-access branches when response.locals.user is absent, returning all workspaces and their content without per-user filtering. The affected endpoints include GET /api/mobile/auth, POST /api/mobile/send/workspaces, and POST /api/mobile/send/workspace-content. The advisory includes detailed HTTP request sequences demonstrating the exploit (GitHub Advisory).

An attacker possessing a pre-migration mobile device token can enumerate all workspaces on the instance — including those assigned exclusively to other users — and retrieve sensitive workspace content such as thread metadata, chat prompts, and chat responses belonging to victim users. The confidentiality impact is limited to data exposure (no integrity or availability impact), but the exposed data may include sensitive LLM conversation history and proprietary workspace content. The vulnerability only manifests after a single-user to multi-user mode migration, limiting its scope to instances that have undergone this transition (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including concrete curl-equivalent HTTP request sequences that demonstrate cross-user data exfiltration. The EPSS score is approximately 0.031% (low probability of near-term exploitation). There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. Exploitation requires the attacker to already possess a mobile device token approved during single-user mode, which limits the attack surface to scenarios where the attacker had prior access to the instance before migration (GitHub Advisory).

1. Obtain a pre-migration mobile token: While the AnythingLLM instance is still in single-user mode, call GET /api/mobile/connect-info to retrieve a temporary registration token from the returned connectionUrl.
2. Register a mobile device: Send POST /api/mobile/register with the registration token and a device payload (e.g., {"deviceOs":"android","deviceName":"legacy-android"}). The server creates a device record with userId: null.
3. Approve the device: Send POST /api/mobile/update/1 with {"approved":true} to approve the device. Confirm via GET /api/mobile/devices that the device has userId: null and approved: true.
4. Wait for or trigger mode migration: The instance administrator enables multi-user mode via POST /api/system/enable-multi-user. Victim users and their workspaces are created in this mode.
5. Authenticate with the stale token: Send GET /api/mobile/auth with the header x-anythingllm-mobile-device-token: <stale_token>. The middleware accepts the token despite the null userId, returning {"success":true}.
6. Enumerate victim workspaces: Send POST /api/mobile/send/workspaces with the stale token header. The unscoped handler returns all workspaces, including those assigned only to victim users.
7. Retrieve victim workspace content: Send POST /api/mobile/send/workspace-content with {"workspaceSlug":"victim-space"} and the stale token. The response includes thread metadata and full chat records (prompts and responses) belonging to the victim user (GitHub Advisory).

• Network: HTTP requests to GET /api/mobile/auth, POST /api/mobile/send/workspaces, and POST /api/mobile/send/workspace-content using the x-anythingllm-mobile-device-token header from unexpected or unrecognized client IPs; successful 200 responses to these endpoints from a device not associated with any registered user.
• Logs: Application logs showing authenticated mobile API access where the associated device record has userId: null; access log entries for /api/mobile/send/workspaces or /api/mobile/send/workspace-content returning workspace data for a device with no user binding.
• Database: Records in the desktop_mobile_devices table with approved = true and userId = null after multi-user mode has been enabled; these orphaned records indicate unmitigated pre-migration tokens (GitHub Advisory).

Upgrade AnythingLLM to version 1.13.0 or later, which includes a fix that migrates all mobile device records with userId = null to the admin user during multi-user mode enablement (via the new MobileDevice.migrateDevicesToMultiUser() function). If immediate patching is not possible, manually invalidate or delete all mobile device records with userId = null in the database before or immediately after enabling multi-user mode. As an additional precaution, consider disabling mobile authentication endpoints until the patch is applied (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher c4tzzz and published by AnythingLLM maintainer timothycarambat via GitHub Security Advisories on May 19, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).