CVE-2026-31863 is a medium-severity local authentication bypass vulnerability affecting Anytype Heart, Anytype CLI, and Anytype Desktop versions prior to 0.48.4, 0.1.11, and 0.54.5 respectively. This flaw allows an attacker with local, low-privileged access to bypass the 4-digit code challenge for the gRPC client API. Rated with a CVSS score of 4.4, the vulnerability has a low impact on confidentiality and integrity, with no impact on availability. There is currently no evidence of active exploitation, and public exploit code is not available in common databases. Community discussion and media coverage are minimal, and its Exploit Prediction Scoring System (EPSS) score is extremely low, suggesting a very low probability of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.1.11CPE matchmatch criteria | cpe:2.3:a:anytype:anytype_cli:*:*:*:*:*:*:*:* | ||
< 0.54.5CPE matchmatch criteria | cpe:2.3:a:anytype:anytype_desktop:*:*:*:*:*:*:*:* | ||
< 0.48.4CPE matchmatch criteria | cpe:2.3:a:anytype:anytype_heart:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.