CVE-2025-63390
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anythingllm | anythingllm | 1.8.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-63390 is an authentication bypass vulnerability in AnythingLLM version 1.8.5 affecting the /api/workspaces endpoint. This endpoint does not properly check for authentication, allowing unauthenticated remote attackers to send requests and receive detailed information about all configured workspaces. The exposed information includes workspace identifiers, AI model configurations, system prompts, operational parameters, vector search settings, chat modes, and timestamps. [1]
How can this vulnerability impact me? :
This vulnerability can lead to significant information disclosure, exposing sensitive configuration details of workspaces to unauthorized users. Attackers can enumerate all workspaces and gain insights into AI model settings and operational parameters, which may facilitate privilege escalation and unauthorized access to workspace resources, posing a high-severity security risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending an unauthenticated HTTP GET request to the /api/workspaces endpoint of an AnythingLLM v1.8.5 instance. If the response returns HTTP 200 status and discloses detailed workspace information without requiring authentication, the system is vulnerable. A sample command using curl would be: curl -i http://<target-host>/api/workspaces [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /api/workspaces endpoint by implementing proper authentication checks and access controls in the middleware. Until a patch or update is available, consider network-level protections such as firewall rules to limit access to trusted users only. [1]