CVE-2025-61679

Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data

State: Published
Severity: 7.7 High
Published: Oct 3, 2025
Updated: Oct 6, 2025
Reserved: Sep 29, 2025

Description

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-287 Improper Authentication

Affected Products

Product	Versions
anyqueryjulien040	< 0.4.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.