CVE-2026-32891

{"id": "CVE-2026-32891", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2026-03-20T03:16:00.240", "references": [{"url": "https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-212"}, {"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2."}, {"lang": "es", "value": "Anchorr es un bot de Discord para solicitar pel\u00edculas y programas de TV y recibir notificaciones cuando se a\u00f1aden elementos a un servidor de medios. Las versiones 1.4.1 e inferiores contienen una vulnerabilidad XSS almacenada en el selector de usuario de Jellyseerr. Jellyseerr permite a cualquier titular de cuenta ejecutar JavaScript arbitrario en la sesi\u00f3n del navegador del administrador de Anchorr. El script inyectado llama al endpoint autenticado /api/config - que devuelve la configuraci\u00f3n completa de la aplicaci\u00f3n en texto plano. Esto permite al atacante forjar un token de sesi\u00f3n de Anchorr v\u00e1lido y obtener acceso de administrador completo al panel de control sin conocimiento de la contrase\u00f1a de administrador. La misma respuesta tambi\u00e9n expone las claves API y los tokens para cada servicio integrado, lo que resulta en la toma de control simult\u00e1nea de la cuenta del servidor de medios Jellyfin (a trav\u00e9s de JELLYFIN_API_KEY), del gestor de solicitudes Jellyseerr (a trav\u00e9s de JELLYSEERR_API_KEY), y del bot de Discord (a trav\u00e9s de DISCORD_TOKEN). Este problema ha sido solucionado en la versi\u00f3n 1.4.2."}], "lastModified": "2026-03-27T16:09:54.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openvessl:anchorr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "584CDEBF-7E62-4732-A6FD-64B3384C3834", "versionEndIncluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}