Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #2753] [BUG]: when logging in to anythingllm using SSO as default user I see the create workspace button available. #1770

New Issue
Closed
opened 2026-02-22 18:26:26 -05:00 by yindo · 1 comment
yindo commented 2026-02-22 18:26:26 -05:00
Owner
Copy Link
Copy Source

Originally created by @shreyshreya on GitHub (Dec 3, 2024).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2753

How are you running AnythingLLM?

Docker (remote machine)

What happened?

I login to anythingllm instance using SSO auth token as default user of a workspace and can see create workspace, settings edit buttons enabled . The same are disabled when you login through login screen but visible only when logging in using SSO. The actual functionality is that these options should not be visible to default user.

Screenshot 2024-12-02 at 10 39 46 AM

Are there known steps to reproduce?

Go to <your-anythingllm-instance/api/docs>
try the api <v1/users//issue-auth-token> (give userid of user with default role)
use the token generated as response to the api call with your anythingllm instance url like : /
you will be logged in to anythingllm instance as userid but can see the create workspace and other things which usually should be disabled for default role.

Originally created by @shreyshreya on GitHub (Dec 3, 2024). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2753 ### How are you running AnythingLLM? Docker (remote machine) ### What happened? I login to anythingllm instance using SSO auth token as default user of a workspace and can see create workspace, settings edit buttons enabled . The same are disabled when you login through login screen but visible only when logging in using SSO. The actual functionality is that these options should not be visible to default user. <img width="1509" alt="Screenshot 2024-12-02 at 10 39 46 AM" src="https://github.com/user-attachments/assets/884fe24c-38e0-49bb-be83-4ed2d64fed87"> ### Are there known steps to reproduce? Go to <your-anythingllm-instance/api/docs> try the api <v1/users/<userid>/issue-auth-token> (give userid of user with default role) use the token generated as response to the api call with your anythingllm instance url like : <anythingllm-url>/<sso-token> you will be logged in to anythingllm instance as userid but can see the create workspace and other things which usually should be disabled for default role.
yindo added the possible bug label 2026-02-22 18:26:26 -05:00
yindo closed this issue 2026-02-22 18:26:26 -05:00
yindo commented 2026-02-22 18:26:27 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Dec 11, 2024):

Reproduction steps:

  • Enable multi user mode
  • Enable Simple SSO via ENV
  • Create admin account
  • Create default user role (id: 2)
  • Create API Key
  • Issue temp auth token for user id 2 - get endpoint
  • Open incognito window and visit SSO URL

Results:

  • I am logged in as the proper account, but I can see the create workspace button
    -> If i try to create a workspace i am Unauthorized as expected
    -> Page reload also removes button

This seems to be a UI issue, not a security one as the security features work as expected. Its just the initial page load.

@timothycarambat commented on GitHub (Dec 11, 2024): Reproduction steps: - Enable multi user mode - Enable Simple SSO via ENV - Create admin account - Create `default` user role (id: 2) - Create API Key - Issue temp auth token for user id `2` - get endpoint - Open incognito window and visit SSO URL Results: - I am logged in as the proper account, but I can see the create workspace button -> If i try to create a workspace i am `Unauthorized` as expected -> Page reload also removes button This seems to be a UI issue, not a security one as the security features work as expected. Its just the initial page load.
yindo changed title from [BUG]: when logging in to anythingllm using SSO as default user I see the create workspace button available. to [GH-ISSUE #2753] [BUG]: when logging in to anythingllm using SSO as default user I see the create workspace button available. 2026-06-05 14:42:35 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label possible bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#1770
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?