An authenticated user with manager or admin privileges can delete any parsed file by specifying its numeric identifier. The delete operation performs a sole primary‑key lookup without checking the owning workspace or user, and runs in cleanup blocks even when an ownership check fails, causing the file to be removed while the response still indicates "File not found." This permits overt data tampering and loss of user‑specific content, affecting confidentiality and integrity.

The vulnerability exists in Mintplex‑Labs AnythingLLM versions 1.11.1 through 1.14.1, inclusive. Any deployment of these releases using the /api/workspace/:slug/embed-parsed-file/:fileId endpoint is susceptible. The fix is introduced in 1.14.1 and later builds, so older releases remain at risk.

Because the flaw allows a privileged user to enumerate and delete files across any workspace, the risk is high for multi‑tenant installations. The EPSS score is not reported, but the lack of an ownership check and the response consistency imply that exploitation is straightforward for users who accidentally or deliberately maintain elevated roles. The vulnerability is not listed in CISA KEV, yet its severity and broad impact warrant immediate mitigation.