Unauthenticated VectorDB deletion via exposed debug route

Improper authorization in AnythingLLM before 1.0.0 allows remote attackers to delete VectorDB namespaces through the /api/v/ route. The route takes a command path parameter, checks only that it names a VectorDb property, and invokes that method with the request body without authorization. No credentials or user interaction are required; reset or delete commands erase document embeddings across all workspaces, while listing exposes private workspace names.