CVE-2024-0795 is a high severity (CVSS 7.2) improper access control flaw in Mintplex Labs AnythingLLM. A user with the admin or manager role can create a new admin account because the backend does not block it. Update to a build with the upstream fix commit.
What's affected
AnythingLLM from Mintplex Labs. The record gives no version range. It says that if someone has access with the admin or manager role, no backend authorization prevents creating a new user with the admin role, and that account then holds elevated privileges.
The references include upstream commit 9a237db and a huntr bounty page. No fixed version is named, so check the release notes for the first release that includes the commit.
The record classifies the weakness as CWE-284 (improper access control). NVD scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
If you run from a git clone, test whether your checkout includes the fix commit:
git merge-base --is-ancestor 9a237db3d1f66cdbcf5079599258f5fb251c5564 HEAD && echo patched
For Docker deployments, compare the image tag or digest with the project's release notes. Also open the user list in the instance settings and look for admin accounts you do not recognise.
What to do now
- Update AnythingLLM to a release that includes upstream commit 9a237db.
- Audit the user list and remove admin or manager accounts that should not exist.
- Reduce the number of people with the manager role to those who need it.
- Rotate API keys and connected provider credentials if you find an unexplained admin account.
Why it matters
Improper access control (CWE-284) here means the interface hid an option but the server did not enforce it. A UI that limits what a manager can do is a convenience. Only a check on the server is a control.
The score is high rather than critical because the attacker needs a privileged role first. Even so, a manager turning into an admin breaks the separation of duties many teams rely on.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Who can exploit this?
Someone who already holds the admin or manager role, according to the record. It matters most where that role is shared widely.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
