CVE-2025-61679

Published: Oct 3, 2025Modified: Jun 17, 2026Deferred

7.7

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.5 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (3)

https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3

Source: security-advisories@github.com

https://github.com/julien040/anyquery/releases/tag/0.4.4

Source: security-advisories@github.com

https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7

Source: security-advisories@github.com

Timeline

No history available yet.