Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 4 | Disclosure3General1 |
| 2026-03-22 | 1 | Disclosure1 |
CVE-2026-32891 Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a sto… https://www.cve.org/CVERecord?id=CVE-2026-32891
Post summary
The post notes a vulnerability in the Anchorr Discord bot affecting versions 1.4.1 and below, but it provides no PoC, exploit, patch, or evidence of active exploitation.
🔴 CVE-2026-32891 - Critical Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability... https://www.thehackerwire.com/vulnerability/CVE-2026-32891/ https://t.co/2NDLcIkrKE
Post summary
The post discloses a critical stored XSS flaw (CVE-2026-32891) in the Anchorr Discord bot, without mentioning a PoC, exploit tool, or patch details.
🚨 CVE-2026-32891: Anchorr Privilege Escalation: Je... Stored XSS in media bot turns any Jellyseerr user into full admin—one malicious request dumps all API keys, session tok... https://zerodaysignal.com/vulnerability/CVE-2026-32891 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2026‑32891, a stored XSS in Jellyseerr’s media bot that leads to privilege escalation and credential theft, and provides a link potentially containing a PoC.
CVE-2026-32891 Stored XSS in Anchorr Discord Bot Leads to Complete Multi-Service Compromise https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32891
Post summary
The snippet announces a stored XSS vulnerability (CVE‑2026‑32891) in the Anchorr Discord Bot that could lead to multi‑service compromise, without providing PoC, exploit code, or patch details.
[CVE-2026-32891: CRITICAL] Anchorr Discord bot versions 1.4.1 and below are vulnerable to stored XSS in Jellyseerr user selector, enabling attackers to access plaintext config data and gain full admin access...#cve,CVE-2026-32891,#cybersecurity https://cvefind.com/CVE-2026-32891
Post summary
The post announces CVE-2026-32891, a critical stored XSS vulnerability in Anchorr Discord bot versions 1.4.1 and below, enabling attackers to read config data and gain full admin access; it provides technical details but no PoC, exploit tool, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openvessl | anchorr | - | - | - |