Secuno
ENNL
Book demo

CVE-2026-32891

Openvessl Anchorr vulnerability

9.0 CRITICALEPSS 0.27%
  1. Published20 Mar 2026

Description

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

Openvessl Anchorr≤ 1.4.1

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-850948.8
The Canva Android App before 2.376.0 did not restrict the headers returned to an…
CVE-2026-528548.6
Maps is a MediaWiki extension that enables visualization of geographic data through…
CVE-2024-583558.9
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting…
CVE-2024-583538.9
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site…
CVE-2026-439388.1
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the…
CVE-2026-428809.6
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions…

Frequently asked

Is CVE-2026-32891 being actively exploited?

CVE-2026-32891 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.27%.

How severe is CVE-2026-32891?

CVE-2026-32891 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 0.27% probability of exploitation.

Which products are affected by CVE-2026-32891?

Affected products include Openvessl Anchorr.

How do I fix CVE-2026-32891?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-32891 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.