CVE-2024-0404: A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of…

PriorityP359critical9.1CVSS 3.0

AVNACLPRNUINSUCHIHAN

EPSS

0.78%

51.4th percentile

A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mintplex-labs	mintplex-labs_anything-llm	>= unspecified < 1.0.0	1.0.0
mintplexlabs	anythingllm	< 1.0.0	1.0.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.