CVE-2026-55611

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 through 1.14.0

Description An issue exists where the application fails to perform ownership checks when deleting parsed files. Specifically, the 'POST /api/workspace/:slug/embed-parsed-file/:fileId' endpoint deletes the target file using only the primary key within finally{} blocks, which execute even if the initial ownership-checked read operation fails. This allows a manager or admin in multi-user mode to delete any user's parsed file across any workspace, including those they are not members of, by enumerating integer fileId values. The system may return a "File not found" message while the deletion still occurs.

Recommendations Update to version 1.14.1.