PatchTheCVECVE-2026-42456: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
CVE-2026-42456 is a medium-severity flaw (CVSS 4.3) affecting anythingllm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for another user's chat response within the same workspace because the route validates workspace membership but does not enforce ownership of the targeted chat row. As a result, an authenticated user can access anoth
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-42456?
anythingllm: upgrade to 1.12.1. Exact commands for each OS are on this page.
Is CVE-2026-42456 being exploited?
CVE-2026-42456 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-42456 affect?
CVE-2026-42456 affects anythingllm. Severity is medium (CVSS 4.3). AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for an
How urgent is CVE-2026-42456?
Priority 26/100. Public exploit reference
Related CVEs
- CVE-2026-5627 HIGH 7.2 UPGRADE A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within
- CVE-2026-41318 MEDIUM 5.4 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-48116 HIGH 7.5 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-47713 LOW 2.0 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-45403 LOW 2.0 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur