CVE-2024-8196
Critical
Description
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
SeverityCritical
CVSS9.8
Exploit probability—
ProductMintplexlabs Anythingllm Desktop
PublishedMar 20, 2025
First seenMar 20, 2025
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- mintplexlabs anythingllm_desktop1.6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mintplexlabs anythingllm_desktop | v < 1.6.5 | 1.6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.