A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with default role to delete documents uploaded by admin. Despite the intended restriction that prevents default role users from deleting admin-uploaded documents, an attacker can exploit this vulnerability by sending a crafted DELETE request to the /api/system/remove-document endpoint. This vulnerability is due to improper access control checks, enabling unauthorized document deletion and potentially leading to loss of data integrity.
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.