AnythingLLM's TTS endpoint allows an authenticated user to retrieve spoken audio of another user's private chat response if the chat ID can be guessed or known. The endpoint verifies only workspace membership and lacks ownership checks, exposing confidential content through an IDOR vulnerability. This results in unaffiliated users hearing private conversations without permission, compromising confidentiality.

Mintplex‑Labs' AnythingLLM application, version prior to 1.12.1, is affected. The vulnerability exists in any deployment of AnythingLLM that exposes the /api/workspace/:slug/tts/:chatId endpoint without enforcing chat ownership. Only versions older than 1.12.1 are vulnerable; 1.12.1 and later include the fix.

The CVSS score of 4.3 indicates low severity under the metric set. The EPSS score is not available, so no insight into current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires login to the same workspace and the target chat ID, the threat vector is likely internal user-based or through ID enumeration. The lack of a publicly known exploit lowers immediate risk, but any authenticated user can still access sensitive audio, warranting prompt remediation.