CVE-2024-0798
Severity:
HIGH
Type:
Unavailable / Other
Publication date:
26/02/2024
Last modified:
16/04/2024
Description
A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this vulnerability by sending a crafted DELETE request to the /api/system/remove-document endpoint. This vulnerability is due to improper access control checks, enabling unauthorized document deletion and potentially leading to loss of data integrity.
Impact
Base Score 3.x
8.10
Severity 3.x
HIGH