AnythingLLM Authentication Bypass Vulnerability in Workspaces API Endpoint

A vulnerability allowing authentication bypass has been identified in AnythingLLM version 1.8.5. This issue arises in the '/api/workspaces' endpoint, which lacks proper authentication checks. As a result, unauthenticated remote attackers can enumerate and access detailed information about all configured workspaces. The exposed data includes workspace identifiers, AI model configurations, system prompts, operational parameters, vector search settings, chat modes, and timestamps.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive workspace information, including configuration and prompt data. This could potentially allow an attacker to escalate privileges by gaining direct access to workspace resources.