{
 "id": "AIR-2026-0991",
 "slug": "cve-2026-32715-anythingllm-privilege-escalation-and-credenti",
 "title": "CVE-2026-32715: AnythingLLM Privilege Escalation and Credential Exposure",
 "summary": "AnythingLLM versions 1.11.1 and earlier suffer from an authorization flaw allowing managers to access generic endpoints and read plaintext SQL database credentials or overwrite settings. The issue has been disclosed via CVE-2026-32715.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "AnythingLLM"
 ],
 "incident_date": "2026-03-16",
 "incident_date_precision": "day",
 "first_reported": "2026-03-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32715",
   "publisher": "NVD",
   "title": "CVE-2026-32715: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.",
   "published_at": "2026-03-16"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-32715",
  "privilege-escalation"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}