CVE-2026-32891 - Vulnerability Analysis

Overview

Anchorr <= 1.4.1 contains a stored XSS caused by unsanitized input in the Jellyseerr user selector, letting any account holder execute arbitrary JavaScript in the admin's browser, exploit requires attacker to have an account.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript, steal admin session tokens, and gain full admin access including API keys, leading to full account takeover.

Mitigation

Upgrade to version 1.4.2 or later.

References

• https://github.com/openVESSL/Anchorr/releases/tag/v1.4.2
• https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🔴 CVE-2026-32891 - Critical (9) Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any acco... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32891/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner