{"data":{"id":"5d8a2d64-b7f9-43a5-9877-96e2e7e14607","title":"CVE-2025-63390: An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint…","summary":"An authentication bypass in AnythingLLM v1.8.5 (CVE-2025-63390) lies in the /api/workspaces endpoint, which fails to implement proper authentication checks. Unauthenticated remote attackers can enumerate and retrieve detailed information on all configured workspaces, including identifiers, AI model configurations, system prompts (openAiPrompt), operational parameters, vector search settings, chat modes and timestamps.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-63390","publishedAt":"2025-12-18T16:15:54.867Z","cveId":"CVE-2025-63390","cweIds":["CWE-306"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AnythingLLM v1.8.5"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AnythingLLM authentication bypass in /api/workspaces endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00552,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-m6qc-6c6w-6687"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:23.274Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[]}}