Anytype Heart, the middleware underlying Anytype, permits a challenge‑based authentication for its local gRPC client API to be bypassed. This flaw allows an attacker to gain API access without providing the required 4‑digit code. The weakness, an example of insecure authentication (CWE‑307), can enable unauthorized local users to query or modify data through the API.

The affected products are anyproto:anytype-cli, anyproto:anytype-heart, and anyproto:anytype-ts. Installations of these components that are older than the fixed releases—anytype‑heart 0.48.4, anytype‑cli 0.1.11, and Anytype Desktop 0.54.5—remain vulnerable. The vulnerability applies to local deployments where the API is accessible.

The CVSS score is 3.6, indicating low severity. The EPSS score is less than 1 %, representing a very low but non‑zero exploitation probability. The issue is not cataloged in the CISA KEV list. Because the attack vector involves local exploitation of the gRPC client API, an attacker with local system access can bypass the authentication challenge. No public exploit is documented; the low severity and exploitation probability suggest limited risk, but any local adversary could gain unauthorized API access.