CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@huntr.dev

Published

2025-03-20

Last modified

2025-10-15

Weaknesses

CWE-862

Affected products

• Mintplex-labsanything-llm (Mintplex-labs)
• Anythingllm Docker (Mintplexlabs)

References

• https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45a
• https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f