What is CVE-2026-72917?

CVE-2026-72917 is a medium-severity vulnerability in Mintplex-labs Anything-llm, classified under CWE-180. CVSS score: 5.9/10. Published 2026-08-10.

How severe is CVE-2026-72917?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Auth bypass in Mintplex-labs Anything-llm

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js…

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Mintplex-labs Anything-llm — versions Affected versions >= 1.0.0, <= 1.15.0

Weakness classification (CWE)

CWE-180
CWE-287 — Improper Authentication

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-72917?: CVE-2026-72917 is a medium-severity vulnerability in Mintplex-labs Anything-llm, classified under CWE-180. CVSS score: 5.9/10. Published 2026-08-10.
How severe is CVE-2026-72917?: Medium severity. CVSS v3 base score is 5.9 out of 10.