TI-2026-24415 Aliases CVE-2026-31863 GHSA-vv3h-7qwr-722v

Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart

LOW 19CWE-307Published 2026-03-11 · Updated 2026-03-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00122 1st percentileScored 2026-11-07

Fix Fixed anytype-heart (anyproto): 0.48.4anytype-cli (anyproto): 0.1.11+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
anyproto	anytype-heart	before 0.48.4	0.48.4	Patch available	CNA
anyproto	anytype-cli	before 0.1.11	0.1.11	Patch available	CNA
anyproto	anytype-ts	before 0.54.5	0.54.5	Patch available	CNA
—	github.com/anyproto/anytype-heart (Go)	before 0.48.4	0.48.4	Patch available	GHSA-vv3h-7qwr-722v
—	github.com/anyproto/anytype-cli (Go)	before 0.1.11	0.1.11	Patch available	GHSA-vv3h-7qwr-722v

anytype-heart Vendoranyproto Affected before 0.48.4 Fixed in 0.48.4 Patch available CNA
anytype-cli Vendoranyproto Affected before 0.1.11 Fixed in 0.1.11 Patch available CNA
anytype-ts Vendoranyproto Affected before 0.54.5 Fixed in 0.54.5 Patch available CNA
github.com/anyproto/anytype-heart (Go) Vendor— Affected before 0.48.4 Fixed in 0.48.4 Patch available GHSA-vv3h-7qwr-722v
github.com/anyproto/anytype-cli (Go) Vendor— Affected before 0.1.11 Fixed in 0.1.11 Patch available GHSA-vv3h-7qwr-722v

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:anytype:anytype_cli::::::::	before 0.1.11	Vulnerable	Anytype
cpe:2.3:a:anytype:anytype_desktop::::::::	before 0.54.5	Vulnerable	Anytype
cpe:2.3:a:anytype:anytype_heart::::::::	before 0.48.4	Vulnerable	Anytype

cpe:2.3:a:anytype:anytype_cli:*:*:*:*:*:*:*:* Versions before 0.1.11 Vulnerable ·Anytype
cpe:2.3:a:anytype:anytype_desktop:*:*:*:*:*:*:*:* Versions before 0.54.5 Vulnerable ·Anytype
cpe:2.3:a:anytype:anytype_heart:*:*:*:*:*:*:*:* Versions before 0.48.4 Vulnerable ·Anytype

Remediation

Fix · CNA anytype-heart (anyproto) Fixed in 0.48.4
Fix · CNA anytype-cli (anyproto) Fixed in 0.1.11
Fix · CNA anytype-ts (anyproto) Fixed in 0.54.5
Fix · GHSA-vv3h-7qwr-722v github.com/anyproto/anytype-heart (Go) Fixed in 0.48.4 Advisory →
Fix · GHSA-vv3h-7qwr-722v github.com/anyproto/anytype-cli (Go) Fixed in 0.1.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-31863
2026-10-03 Alias added: GHSA-vv3h-7qwr-722v

References

Patch 1

https://github.com/anyproto/anytype-heart/security/advisories/GHSA-vv3h-7qwr-722v

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-31863

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences