A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
References
Configurations
No configuration.
History
21 Nov 2024, 09:10
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
References | () https://huntr.com/bounties/a3c69faf-cca0-4c10-8739-57e5bef7a95f - |
07 May 2024, 00:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-05-07 00:15
Updated : 2024-11-21 09:10
NVD link : CVE-2024-2913
Mitre link : CVE-2024-2913
CVE.ORG link : CVE-2024-2913
JSON object : View
Products Affected
No product.
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition