Threats affecting pkg:github/openvessl/Anchorr

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.

CVE-2026-32890 is a critical stored Cross-site Scripting (XSS) vulnerability in the Anchorr Discord bot versions 1.4.1 and below. It allows any unprivileged Discord user within the configured guild to execute arbitrary JavaScript in the admin's browser via the web dashboard's User Mapping dropdown. By exploiting this XSS and chaining it with the GET /api/config endpoint, attackers can retrieve all sensitive credentials stored in Anchorr, including Discord tokens, API keys, JWT secrets, webhook secrets, and bcrypt password hashes, without authentication. This vulnerability affects confidentiality, integrity, and availability and has a CVSS score of 9.7. The issue is fixed in version 1.4.2.