CVE-2024-2913: A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can…

PriorityP338medium6.5CVSS 3.0

AVNACLPRNUINSUCLILAN

EPSS

0.33%

24.2th percentile

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mintplex-labs	mintplex-labs_anything-llm	unspecified – latest	—
mintplexlabs	anythingllm	<= 1.0.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.