A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Mintplexlabs |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-16200 | A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mintplexlabs
Mintplexlabs anythingllm |
|
| CPEs | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Mintplexlabs
Mintplexlabs anythingllm |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:04:49.675Z
Reserved: 2024-01-10T16:43:58.684Z
Link: CVE-2024-0404
Vulnrichment
Updated: 2024-08-01T18:04:49.675Z
NVD
Status : Analyzed
Published: 2024-04-16T00:15:07.387
Modified: 2025-07-09T19:37:47.527
Link: CVE-2024-0404
Redhat
No data.
OpenCVE Enrichment
No data.