CVE-2026-32890 is a critical stored cross site scripting flaw in Anchorr, the Discord bot for media requests, scored CVSS 9.6. A Discord display name could run script in the admin dashboard and read secrets from the config endpoint. Versions 1.4.1 and below are affected, so upgrade to 1.4.2 and rotate credentials.
What's affected
The NVD record says Anchorr 1.4.1 and below are affected, and that 1.4.2 fixes it. The 1.4.2 release notes say the release patches two critical stored XSS issues, one through Discord member display names and one through Jellyseerr usernames, which have separate advisories.
The record says any unprivileged Discord user in the configured guild could trigger the first one, which is a large audience.
How to check if you're exposed
Check the version in the dashboard footer or in your container tag and compare it with 1.4.2.
If you were on 1.4.1 or older while the bot sat in a public or large Discord server, assume the secrets could have been read. The record says the config endpoint returned secrets in plaintext, including the Discord token, API keys for Jellyfin and Jellyseerr, the JWT secret, the webhook secret and password hashes.
Review who is in the configured guild, and look at member display names for markup.
What to do now
- Upgrade Anchorr to 1.4.2 or later.
- Rotate every secret the instance holds: the Discord bot token, Jellyfin and Jellyseerr API keys, the JWT secret and the webhook secret.
- Reset admin passwords, since password hashes could have been exposed.
- Keep the dashboard off the public internet.
- Read the release notes for new behavior such as masked config values and login rate limits.
The 1.4.2 release notes list the other changes. Avatar URLs are now validated against cdn.discordapp.com before use, translation strings are sanitized before they reach the page, and tokens now carry an identifier so logout invalidates them on the server.
The release also adds security response headers and limits login and register endpoints to 20 requests per 15 minutes per IP address. Config values are masked before they are sent to the browser, and the server recognizes masked placeholders on save so credentials are not lost by accident.
The second stored XSS fixed in 1.4.2 came through Jellyseerr usernames and has its own advisory, GHSA-6mg4-788h-7g9g, so one upgrade closes both.
Why it matters
The weaknesses are CWE-79, cross site scripting, and CWE-200, exposure of sensitive information. The release notes say the member dropdown wrote display names into the page with innerHTML. Names are user chosen text, so they must be treated as data and never as markup.
The second half turned a nuisance into a breach. The config endpoint returned all secrets to a logged in admin session, so script running in that session could collect them. The fix changes the page to use safe DOM calls and masks sensitive fields before they reach the browser. The record's KEV flag is false.
Quick check
Why rotate secrets if I just upgrade?
Because the flaw could have exposed them before you patched. A patch stops new leaks but cannot take back a secret that was already read.
Sources
Last reviewed: 19 October 2026.
