# CVE-2026-21484: AnythingLLM - Information Disclosure

> Live exploitation tracking for CVE-2026-21484 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-21484

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Mintplex-Labs AnythingLLM
- **Weaknesses:** CWE-203 (Observable Discrepancy); CWE-204 (Observable Response Discrepancy)
- **Tags:** ai_mcp, web_application

## Description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.

## CrowdSec analysis

[CVE-2026-21484](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-21484) is an information disclosure vulnerability in AnythingLLM that allows attackers to enumerate valid usernames via the password recovery endpoint, due to differing error messages. This flaw could be exploited to aid in targeted attacks such as credential stuffing or brute-force attempts by confirming the existence of user accounts.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-21484 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-21484. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers target the `/api/system/recover-account` endpoint by submitting password recovery requests with different usernames, allowing them to enumerate valid usernames based on variations in the error messages returned.

## Timeline

- 2026-01-03: CVE Published. CVE-2026-21484 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-21484 exploitation attempts against the CrowdSec Network.
- 2026-05-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-21484 for the first time.

## References

- https://github.com/Mintplex-Labs/anything-llm/commit/e287fab56089cf8fcea9ba579a3ecdeca0daa313
- https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21484.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-21484) follows observed exploitation activity for CVE-2026-21484. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.