THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-72917 (MEDIUM 5.9) — AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the

[NVD] CVE-2026-72917 (MEDIUM 5.9) — AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the

lownvdPublished 2026-08-10

CVE-2026-72917 CVSS: 5.9 MEDIUM Published: 2026-08-10T22:17:10.660

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so o

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72917