The vulnerability is a permissive cross‑origin resource sharing (CORS) policy combined with the absence of authentication for all HTTP endpoints and the agent WebSocket in default installations of AnythingLLM prior to version 1.11.1. The server accepts requests from any origin, so a malicious web page can issue requests to the local server and read the responses without any credentials. This flaw effectively removes the first line of defense on the application, allowing an attacker who can reach the server over the local network to retrieve or manipulate data that the server should protect. The weakness is further classified as CWE‑1188 (misconfigured cross‑origin resource sharing) and CWE‑942, indicating a design flaw that allows unwanted data disclosure.

Affected are Mintplex‑Labs AnythingLLM installations running version 1.11.1 or earlier. In these default installations no password or API key has been configured, all HTTP endpoints and the WebSocket are left unauthenticated, and the CORS policy is set to allow any origin. The server binds to 127.0.0.1 by default; however, browsers that implement Private Network Access (PNA) block public websites from making requests to local IP addresses, which means the vulnerability is exploitable only from within the same local area network (LAN). Any machine in the LAN can host a malicious web page that the victim’s browser can load and that can then communicate with the AnythingLLM server.

The CVSS v3.1 score is 7.1, indicating a high severity flaw that compromises the confidentiality and integrity of data on the host. The EPSS value is less than 1 %, indicating that while the flaw is theoretically serious, the probability of real‑world exploitation is low due to the limited attack vector. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local network access, use of a browser that loads a malicious site, and the ability to read responses returned with a permissive CORS header. Once these prerequisites are fulfilled, an attacker can send arbitrary requests to the server and consume the returned data, potentially escalating to full data disclosure or modification if lateral movement or network compromise occurs.