CVE-2024-2913

CVE-2024-2913 is a race condition vulnerability affecting the mintplex-labs/anything-llm repository, specifically in the user invite acceptance process. An attacker can exploit this by sending multiple concurrent requests to accept a single user invite, leading to the creation of multiple unauthorized user accounts from one invite link. This bypasses the intended single-use restriction due to a lack of backend validation for concurrent requests. The vulnerability has a CVSS score of 6.5 (MEDIUM), indicating it can be exploited remotely with low complexity and no user interaction, potentially leading to unauthorized information disclosure and modification. While the EPSS score is low, the FAUCET Risk Score is 36/100, suggesting a moderate risk. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for the vast majority of vulnerabilities.