CRITICAL🇵🇱 Wersja polska

CVE-2026-32890

CVSS 9.6v3.1pub. 2026-03-20upd. 2026-03-27

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.

🤖 AI Analysis
How it works

The stored XSS vulnerability is located in the User Mapping dropdown menu in the Anchorr web panel. Any Discord user belonging to the configured server (guild) can inject a malicious JavaScript payload, which is saved server-side and executed in the administrator's browser each time the panel is opened. The executed script can then send a request to the GET /api/config endpoint, which returns all application secrets in plaintext without requiring any authentication. The combination of these two weaknesses (CWE-79 and CWE-200) creates a critical attack chain enabling complete theft of authentication data.

Impact

An attacker can exfiltrate all credentials stored in Anchorr, including Discord tokens (DISCORD_TOKEN), Jellyfin and Jellyseerr API keys, JWT secrets and webhooks, as well as bcrypt password hashes, thereby gaining full control over the integrated media infrastructure.

Mitigation & patch

Anchorr should be updated to version 1.4.2, in which the vulnerability has been fixed. The patch is available in the project's GitHub repository (tag v1.4.2). Until the update is applied, it is recommended to restrict access to the administration panel only to trusted networks and to rotate all secrets and API keys stored in the Anchorr configuration.

Who is affected

Anchorr (openVESSL/Anchorr) in versions 1.4.1 and earlier

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  • Openvessl Anchorr

    APP
    Openvessl
    ≤ 1.4.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-32891CRITICAL9.0PL ✓same product

Stored XSS w Anchorr umożliwia przejęcie konta admina i kluczy API