What is CVE-2024-13060?

CVE-2024-13060 is a medium-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under Missing Authorization. CVSS score: 4.3/10. Published 2025-03-20.

How severe is CVE-2024-13060?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Mintplex-Labs Mintplex-Labs/anything-Llm

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Vulnerability class: Broken Access Control

EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mintplex-labs Mintplex-labs/anything-llm — versions unspecified
Mintplexlabs Anythingllm_docker

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@huntr.dev (Exploit)
security@huntr.dev (Patch)

Frequently asked questions

What is CVE-2024-13060?: CVE-2024-13060 is a medium-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under Missing Authorization. CVSS score: 4.3/10. Published 2025-03-20.
How severe is CVE-2024-13060?: Medium severity. CVSS v3 base score is 4.3 out of 10.