Manager-to-Administrator escalation via nested database writes

Improper input validation in Mintplex Labs AnythingLLM allows remote authenticated users with manager access to create Administrator accounts. The workspace update route forwards unvalidated nested JSON into a Prisma update, permitting relation writes that create user records. Exploitation requires a valid manager session and yields a new Administrator account with application-wide administrative privileges.