CVE-2026-72917: 
AnythingLLM vulnerability analysis and mitigation

CVE-2026-72917 is an authentication bypass vulnerability in AnythingLLM's account recovery flow, allowing an attacker with knowledge of one valid recovery code to take over any account, including administrator accounts. It affects AnythingLLM versions 1.0.0 through 1.15.0 (inclusive), developed by Mintplex-Labs. The vulnerability was discovered by researcher Gabriel Gomes Almeida and disclosed via a GitHub Security Advisory (GHSA-vv8w-wg6r-hq56) published on July 15, 2026, with NVD publication on August 10, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium), though the reporter suggested a higher score of 8.1 (High) given the full account takeover potential (GitHub Advisory).

The root cause is a canonicalization-before-validation ordering flaw (CWE-180: Incorrect Behavior Order: Validate Before Canonicalize) combined with improper authentication logic (CWE-287). In server/utils/PasswordRecovery/index.js, the recoverAccount() function deduplicates raw recovery code inputs using a JavaScript Set before trimming whitespace, meaning two strings like "CODE" and " CODE" are treated as distinct values and both pass the uniqueness check. After trimming, both normalize to the same value and are each independently compared against all stored bcrypt hashes — without requiring them to match different hashes. This means a single known recovery code, submitted twice with differing surrounding whitespace, satisfies the intended two-of-four code requirement. The vulnerable endpoint POST /api/system/recover-account is reachable without authentication when multi-user mode is enabled, and a successful call returns a password-reset token usable at POST /api/system/reset-password (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to reset the password of any targeted account — including administrator accounts — effectively achieving full account takeover. An attacker who gains administrator access can access or modify all workspaces, documents, chat histories, integrations, LLM configurations, and API keys within the AnythingLLM instance. The vulnerability does not directly expose confidentiality, integrity, or availability of the underlying host system, but full administrative control of the application represents a significant data exposure and integrity risk for all content managed by the platform (GitHub Advisory).

A local proof-of-concept (PoC) was included in the security advisory, demonstrating that the real recoverAccount() implementation issues a password-reset token when one valid recovery code is submitted twice with differing whitespace. The attack requires no authentication and no user interaction, but does require the attacker to know the target username and possess one valid recovery code — conditions that reduce exploitability compared to a fully unauthenticated attack. The EPSS score is approximately 0.00268 (low probability of near-term exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an internet-facing AnythingLLM instance running in multi-user mode (versions 1.0.0–1.15.0). Confirm multi-user mode is active, as the recovery endpoint is only exposed in this configuration.
2. Obtain target username: Enumerate or otherwise obtain the username of the target account (e.g., administrator). A related advisory (GHSA-47vr-w3vm-69ch / CVE-2026-21484) notes that the same endpoint may leak observable error-message differences useful for username enumeration.
3. Obtain one valid recovery code: Acquire one of the target account's four recovery codes through social engineering, phishing, insider access, or prior data exposure.
4. Craft the bypass request: Submit a POST /api/system/recover-account request with the known recovery code provided twice — once as-is and once with leading or trailing whitespace — to exploit the pre-normalization deduplication flaw:

POST /api/system/recover-account HTTP/1.1
Content-Type: application/json

{
  "username": "victim-admin",
  "recoveryCodes": [
    "KNOWN-VALID-UUID",
    " KNOWN-VALID-UUID"
  ]
}

5. Receive reset token: The server responds with success: true and a resetToken value, bypassing the intended two-distinct-code requirement.
6. Reset the password: Supply the received token to POST /api/system/reset-password with a new attacker-controlled password to complete the account takeover.
7. Authenticate as victim: Log in with the new password and exercise full privileges of the compromised account (GitHub Advisory).

• Network: Unexpected POST requests to /api/system/recover-account from external or unfamiliar IP addresses, especially with repeated or near-identical recovery code values in the request body; subsequent POST requests to /api/system/reset-password from the same source shortly after.
• Logs: Application logs showing successful account recovery events (success: true) for administrator or privileged accounts, particularly where the two submitted recovery codes differ only in whitespace; multiple recovery attempts for the same username in a short time window.
• Authentication Events: Unexpected password changes for administrator or high-privilege accounts not initiated by the account owner; new login sessions for administrator accounts from unfamiliar IP addresses or user agents following a recovery event.
• Application Behavior: Unexplained changes to workspace configurations, document access, LLM integrations, or API keys following an administrator account login from an unrecognized source (GitHub Advisory).

Mintplex-Labs patched the vulnerability in commit 61766d06b77b903f66dc4afd8dffb3a39012db14, which is included in versions after 1.15.0. The fix canonicalizes (trims) all recovery code inputs before deduplication, and additionally requires each submitted code to match a distinct stored hash by consuming matched hashes from a working list. Users should upgrade to any version beyond 1.15.0 immediately. No configuration-based workaround is available; disabling multi-user mode would remove the exposed endpoint but is not a practical mitigation for most deployments (Patch Commit, GitHub Advisory).

The advisory was published by Mintplex-Labs maintainer timothycarambat and credits researcher Gabriel Gomes Almeida (GabrielGomesAL) as the reporter. The advisory notes that AI assistance was used in the research process, which is disclosed transparently. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).