| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/anyproto/anytype-cli | < 0.1.11 | 0.1.11 |
| github.com/anyproto/anytype-heart | < 0.48.4 | 0.48.4 |
| anytype cli | < 0.1.11 | 0.1.11 |
| anytype desktop | < 0.54.5 | 0.54.5 |
| anytype heart | < 0.48.4 | 0.48.4 |
The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code.
Affected components:
Not affected:
Who is impacted: This vulnerability is scoped to localhost. The gRPC and gRPC-Web ports bind to 127.0.0.1 only and are not exposed to the local network or internet.
Anytype-CLI headless deployments may be at higher risk only if an administrator has chosen to set up their own reverse proxy and configured it in a way that exposes gRPC or gRPC-Web ports to an external network. By default, these ports are not externally accessible and there is no built-in mechanism to expose them.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free