CVE-2026-32890 - Vulnerability Analysis

Overview

Anchorr <= 1.4.1 contains a stored XSS caused by improper sanitization in the User Mapping dropdown on the web dashboard, letting unprivileged Discord users execute arbitrary JavaScript in admin's browser, exploit requires attacker to be a guild member.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in admin's browser and exfiltrate all stored credentials, leading to full system compromise.

Mitigation

Update to version 1.4.2 or later.

References

• https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2
• https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q
• https://github.com/openVESSL/Anchorr/commit/d5ae67e5b455241274ed0072cf2db43a6eb3f0b2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner