// Security advisory · Published · GitHub Advisory Database
The embed handler passed a visitor-supplied username where a user object was expected, so the memory lookup collapsed to the single-user scope and the instance owner's private Memories were appended to the system prompt on an unauthenticated route.
AnythingLLM’s public embed widget lets anonymous visitors chat with a workspace. The embed handler passed the visitor-supplied username string into the slot where the prompt builder expects a user object. user?.id collapsed to null, and null is exactly the storage scope of the instance owner’s Memories in single-user mode. The owner’s private Memories were appended to the system prompt of every anonymous embed conversation.
Disclosure of the owner’s private Memories to unauthenticated visitors on any instance running single-user mode with Personalization on and an embed widget deployed. A type confusion rather than a missing check: the read path and both production write paths land on the same null scope through the same normaliser, so there is no sentinel that separates the two. Rated Moderate, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), CWE-668.
Reporter credit: 0xiviel / Eva Crystal (XSource Security).
The Qwen2-VL and Qwen3-VL video samplers bound on the request-controlled max_frames value, which the server-side frame ceiling does not reach. One unauthenticated request to /tokenize exhausts API-server memory before admission control.
