CVE-2025-63390: Mintplexlabs Anythingllm

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed data includes: workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.

Affected products

• Mintplexlabs Anythingllm: version 1.8.5 only

Published 2025-12-18. Last modified 2026-06-17.