CVE-2026-32715: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32715 is an incorrect authorization vulnerability in AnythingLLM (by Mintplex Labs) that allows users with the manager role to bypass admin-only access controls on two generic system-preferences API endpoints. Affecting versions 1.11.1 and earlier (up to Git commit e7ebeb47), the flaw enables managers to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and Community Hub API key. It was published on March 13, 2026, with a patch released shortly after. The vulnerability carries a CVSS v3.1 base score of 3.8 (Low) (GitHub Advisory).

The root cause is an access control inconsistency (CWE-863: Incorrect Authorization) in AnythingLLM's admin API layer. Two endpoints — GET /api/admin/system-preferences-for and POST /api/admin/system-preferences — were configured to accept both admin and manager roles via flexUserRoleValid([ROLES.admin, ROLES.manager]), while all other surfaces touching the same settings (e.g., POST /system/default-system-prompt, GET/POST /community-hub/settings) are restricted to admin only. On the read path, agent_sql_connections is included in publicFields, causing the getter to return full connection details (username, password, host, port, database) in plaintext. On the write path, updateSettings() checks supportedFields but does not enforce protectedFields, allowing a manager to overwrite default_system_prompt and hub_api_key. Exploitation requires multi-user mode to be enabled and the attacker to possess a valid manager account JWT (GitHub Advisory, Patch Commit).

A manager-role user can exploit this vulnerability over the network to read plaintext SQL database credentials (including username, password, host, port, and database name) configured as agent SQL connectors, potentially enabling lateral movement to backend databases. Additionally, the attacker can overwrite the global default system prompt — affecting all users of the AnythingLLM instance — and replace the Community Hub API key, disrupting integrations and potentially redirecting hub interactions. Availability is not directly impacted, but confidentiality and integrity of sensitive configuration data are both compromised (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of concrete curl commands targeting the vulnerable endpoints with a manager-role JWT. The exploit requires no special tooling beyond standard HTTP clients and is straightforward to execute given a valid manager account. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.023% (GitHub Advisory).

1. Preconditions: Confirm that the target AnythingLLM instance is running version 1.11.1 or earlier with multi-user mode enabled, and obtain a valid manager-role account (or JWT token).
2. Authenticate: Log in as a manager user and retrieve the JWT bearer token from the session or login response.
3. Read SQL credentials: Send a GET request to the system-preferences-for endpoint with the agent_sql_connections label:

curl -i -sS \
  -H "Authorization: Bearer <manager-jwt>" \
  "/api/admin/system-preferences-for?labels=agent_sql_connections"

The response will include plaintext database credentials (username, password, host, port, database). 4. Overwrite admin-only settings: Send a POST request to modify the default system prompt or Community Hub API key:

curl -i -sS \
  -X POST "/api/admin/system-preferences" \
  -H "Authorization: Bearer <manager-jwt>" \
  -H "Content-Type: application/json" \
  --data '{"default_system_prompt":"ATTACKER_CONTROLLED_PROMPT"}'

A {"success":true,"error":null} response confirms the setting was changed. 5. Leverage credentials: Use the exfiltrated SQL credentials to connect directly to the backend database for further data access or lateral movement (GitHub Advisory).

• Network: Unexpected HTTP GET requests to /api/admin/system-preferences-for?labels=agent_sql_connections originating from manager-role sessions; HTTP POST requests to /api/admin/system-preferences with payloads containing default_system_prompt or hub_api_key from non-admin accounts.
• Logs: Application access logs showing manager-role JWT tokens accessing /api/admin/system-preferences-for or /api/admin/system-preferences endpoints; repeated or automated requests to these endpoints outside normal usage patterns.
• Configuration: Unexpected changes to the default_system_prompt value in system settings (e.g., canary strings or attacker-controlled prompts); rotation or replacement of the hub_api_key.
• Database: Outbound connection attempts to internal database hosts from unexpected sources using credentials stored in agent_sql_connections (GitHub Advisory).

Upgrade AnythingLLM to version 1.11.2 or later (patch commit 732eac6fa89f43288bbb65ecc6298ebcd96b7aeb), which restricts both /api/admin/system-preferences-for and /api/admin/system-preferences to a limited set of fields for manager-role users, aligning API access with frontend access controls. The patch introduces a managerAllowedFields allowlist for both read and write paths, and admin users retain unrestricted access to all supported fields. As a defense-in-depth measure, the advisory recommends removing agent_sql_connections from publicFields and serving it through a dedicated admin-only endpoint, as well as having updateSettings() explicitly reject keys in protectedFields. Audit manager role permissions and review logs for any unauthorized access to system preferences prior to patching (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher u-ktdi and published by AnythingLLM maintainer timothycarambat via GitHub Security Advisories on March 13, 2026. The issue received coverage from security aggregators including CVEFeed, VulDB, and CIRCL's vulnerability database shortly after disclosure. Social media activity was limited, with a brief mention on Bluesky's CVE tracking account (GitHub Advisory).