CVE-2026-32890 - Vulnerability Analysis

Overview

Anchorr <= 1.4.1 contains a stored XSS caused by improper sanitization in the User Mapping dropdown on the web dashboard, letting unprivileged Discord users execute arbitrary JavaScript in admin's browser, exploit requires attacker to be a guild member.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in admin's browser and exfiltrate all stored credentials, leading to full system compromise.

Mitigation

Update to version 1.4.2 or later.

References

• https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q
• https://github.com/openVESSL/Anchorr/commit/d5ae67e5b455241274ed0072cf2db43a6eb3f0b2
• https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🔴 CVE-2026-32890 - Critical (9.6) Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping drop... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32890/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner