{
 "id": "AIR-2026-0990",
 "slug": "cve-2026-32717-api-key-bypass-for-suspended-users-in-anythin",
 "title": "CVE-2026-32717: API key bypass for suspended users in AnythingLLM",
 "summary": "In multi-user mode, AnythingLLM fails to properly block suspended users when they access endpoints via browser extension API keys instead of JWT sessions. This allows unauthorized access to workspace metadata and embed operations.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling",
  "enterprise_deployment"
 ],
 "products": [
  "AnythingLLM"
 ],
 "incident_date": "2026-03-16",
 "incident_date_precision": "day",
 "first_reported": "2026-03-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32717",
   "publisher": "NVD",
   "title": "CVE-2026-32717: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.",
   "published_at": "2026-03-16"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-32717",
  "broken-access-control",
  "api-key"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}