CVE-2026-55611: AnythingLLM Cross-Workspace File Deletion via Authorization Bypass

Technical summary

The POST /api/workspace/:slug/embed-parsed-file/:fileId endpoint implements scoped read access checks for userId and workspaceId, but the corresponding delete logic in finally{} blocks executes unconditionally by primary key only, without ownership validation. An authenticated user with manager or admin privileges can exploit this race condition in control flow to delete arbitrary files across tenant boundaries. The vulnerability allows cross-workspace, cross-user file deletion despite the endpoint returning a misleading "File not found" response.

Business impact

Unauthorized file deletion can disrupt document processing workflows, cause data loss for multi-tenant deployments, and undermine trust in access controls. In collaborative environments, malicious admins or compromised admin accounts pose a significant risk to document integrity and availability across all workspaces. This affects the core function of AnythingLLM as a context aggregation system for LLM interactions.

Affected systems

AnythingLLM versions 1.11.1 through 1.14.0 are affected. The vulnerability is specific to multi-user mode deployments where role-based access is enforced. Single-user instances are not impacted by the authorization bypass since there is no privilege separation.

Exploitability

Exploitation requires valid authentication and manager or admin role within the AnythingLLM instance. An attacker must enumerate fileId values, which are typically sequential integers, making discovery straightforward. The low barrier to exploitation is partially offset by the requirement for elevated privileges; however, insider threats and compromised admin accounts represent realistic attack vectors. No special network position or user interaction is required.

Remediation

Upgrade to AnythingLLM version 1.14.1 or later, which implements proper ownership validation on the embed-parsed-file delete operation. Verify the patch in the vendor advisory before deploying to production. For environments unable to upgrade immediately, consider restricting admin role assignments to trusted personnel and monitoring file deletion logs for anomalies.

Patch guidance

Apply the update to version 1.14.1 as soon as feasible. The fix adds authorization checks that ensure users can only delete files they own or files in workspaces where they have appropriate permissions. Test the patch in a non-production environment to confirm the fix resolves the issue without breaking legitimate file management workflows. Review access logs post-patch to identify any unauthorized deletion attempts that may have occurred during the vulnerable window.

Detection guidance

Monitor API logs for repeated POST requests to /api/workspace/*/embed-parsed-file/* endpoints, particularly from admin or manager accounts. Look for patterns of fileId enumeration (sequential or wide-ranging IDs) and focus on requests that return 404 responses but originate from privileged users accessing workspaces they should not have access to. Audit file deletion events for orphaned or unexpected file removals attributed to users outside the owning workspace.

Why prioritize this

Although the CVSS score reflects low intrinsic severity metrics, the vulnerability carries moderate operational risk in multi-user deployments due to the insider threat vector and the potential for cross-workspace data loss. Priority should reflect your environment: organizations running AnythingLLM in shared, multi-tenant settings should treat this as higher priority; single-user or tightly controlled admin deployments may defer patching slightly, but should still plan an upgrade within a standard maintenance window.

Risk score, explained

The CVSS 3.1 score of 0 (NONE) reflects the requirement for high-privilege authentication and the absence of confidentiality or integrity impact on other users' systems at the CVSS metric level. However, this scoring does not capture the operational impact of unauthorized file deletion within a shared workspace context. For your risk model, consider adjusting the priority based on the sensitivity of documents processed through affected instances and the trustworthiness of your admin population.

Frequently asked questions