GHSA-8wh8-3v68-whwj
AnythingLLM: owner's private Memories disclosed to anonymous embed-widget visitors
The embed handler passed a visitor-supplied username where a user object was expected, so the memory lookup collapsed to the single-user scope and the instance owner's private Memories were appended to the system prompt on an unauthenticated route.