CVSS 3.1
4.4 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NCVE-2026-31863
Medium (4.4) in anytype. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in github.com/anyproto/anytype-heart 0.48.4.
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
- CWE
- CWE-307
- Published
- Modified
- Record from
- the NVD, synced
Affected
- anytype:anytype_cli
- anytype:anytype_desktop
- anytype:anytype_heart
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vv3h-7qwr-722v | Go | github.com/anyproto/anytype-heart | <0.48.4 | 0.48.4 |
| GHSA-vv3h-7qwr-722v | Go | github.com/anyproto/anytype-cli | <0.1.11 | 0.1.11 |
| GO-2026-4680 | Go | github.com/anyproto/anytype-cli | <0.1.11 | 0.1.11 |
| GO-2026-4680 | Go | github.com/anyproto/anytype-heart | <0.48.4 | 0.48.4 |