Incorrect Authorization in Anything LLM custom models endpoint (CVE-2024-10109)
An authorization vulnerability in Anything LLM's custom models endpoint allowed users without proper admin role permissions to access administrative functions. The issue was patched by adding role-based access controls to restrict the endpoint to admin users only.
What happened
The /system/custom-models POST endpoint in Anything LLM lacked proper authorization checks, allowing non-admin users to access the endpoint.
Governance controls
The vulnerability was patched by adding flexUserRoleValid middleware with admin role restriction to the /system/custom-models endpoint.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.