Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts.

N/A

输入验证不恰当

AnythingLLM 输入验证错误漏洞

AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM存在输入验证错误漏洞，该漏洞源于输入验证不当，具有管理员角色的用户能够制作包含嵌套写入操作的请求，从而创建新的管理员帐户。

N/A

N/A