CVE-2026-21484Disclosure(mintplexlabs / anythingllm)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.

mintplexlabs CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313

Exploit / PoC references

https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch

Weakness type (CWE)

CWE-203CWE-204

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

anythingllm

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

mintplexlabs

Products

anythingllm

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://cloud.projectdiscovery.io/library/CVE-2026-21484

Full discourse1 post

pdnuclei-bot@pdnuclei_bot174d
Disclosure
🚨 CVE-2026-21484 - medium 🚨 AnythingLLM - Username Enumeration via Password Recovery > AnythingLLM is an application that turns pieces of content into context that any LLM ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-21484 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2026‑21484, a medium‑severity username enumeration flaw in AnythingLLM’s password recovery feature, but provides no PoC, exploit tool, or patch information.
00011171
930 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mintplexlabs	anythingllm	-	-	-

Explore more

Back to dashboard mintplexlabs CVEs anythingllm vulnerabilities