A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-05-06T23:42:10.887Z

Updated: 2024-08-01T19:25:42.157Z

Reserved: 2024-03-26T14:04:50.427Z

Link: CVE-2024-2913

cve-icon Vulnrichment

Updated: 2024-08-01T19:25:42.157Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-07T00:15:08.590

Modified: 2024-11-21T09:10:49.413

Link: CVE-2024-2913

cve-icon Redhat

No data.