CVE-2024-0551 is a high severity (7.1) access control flaw in AnythingLLM. The data export endpoint was available to the default user role, so any signed in user could export system data. The fix adds a role check to the route. Update to a build that contains the commit.
What's affected
- Product: AnythingLLM by Mintplex Labs.
- Affected: the record lists no version range. The fix is a commit, so check the project's releases for the first tagged version containing it.
- Precondition: the attacker must already have an account on the system.
- Weakness: CWE-284, improper access control.
- Severity: NVD scores it 7.1 (High).
How to check if you're exposed
- Check the version of your AnythingLLM deployment, for example the container image tag or the git commit you built from.
- Compare it with the project's release notes for the commit named in the record.
- Review who has accounts and the default role, and whether multi user mode is on.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Find your deployment and its version or commit.
- Update to a release that includes the role check on the data export route.
- Remove accounts that are not needed.
- Rotate secrets that could be in a database export if you suspect a user abused the endpoint.
- Track the product in an inventory so future advisories reach you.
Why it matters
The weakness is CWE-284, improper access control. The export route checked only that the user was signed in, not what role the user held. The commit adds a role validation step, with the handler logic otherwise unchanged.
The record adds that the export file name is deterministic but the interface deletes the export after download, which it calls lower risk. The record has no known exploited flag. Since an export holds the whole database, the impact is on confidentiality.
Try it yourself
The demo below walks through the same workflow on sample data.
Click through it at your own pace, or open it full screen.
Quick check
Why 7.1 and not higher?
The record requires an existing account, and the impact is mostly confidentiality. The vector in the record shows the exact breakdown.
Sources
I fetched the commit page. I did not fetch the huntr report.
- https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8
- https://huntr.com/bounties/f114c787-ab5f-4f83-afa5-c000435efb78
Last reviewed: 19 October 2026.
