Untriaged
Permalink
CVE-2026-31863
3.6 LOW
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): HIGH
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5.
References
Affected products
anytype-ts
- ==< 0.54.5
anytype-cli
- ==< 0.1.11
anytype-heart
- ==< 0.48.4
Matching in nixpkgs
pkgs.anytype-heart
Shared library for Anytype clients
-
nixos-25.11 0.44.0-nightly.20251220.1
- nixos-25.11-small 0.44.0-nightly.20251220.1
- nixpkgs-25.11-darwin 0.44.0-nightly.20251220.1
Package maintainers
-
@adda0 David Chocholatý <chocholaty.david@protonmail.com>
-
@kira-bruneau Kira Bruneau <kira.bruneau@pm.me>
-
@autrimpo Michal Koutenský <michal@koutensky.net>