Listen to this Post
The vulnerability resides in Anytype’s publish graph endpoints, specifically getGraph and getLocalGraph, which are responsible for returning node-link topology of documents within a workspace. These handlers are registered with CheckAuth-only permission, meaning they are accessible to any publish RoleReader token or even to anonymous users when Publish.Auth.Enable is set to false. The core flaw is that the filtering logic applied to the graph nodes only checks against the visibility tier, using model.GetInvisiblePublishAccess to create a set of “invisible” documents, and then calls FilterGraphByPublishIgnore to drop nodes that are not accessible. However, this filter exclusively evaluates CheckPathAccessableByPublishIgnore, which looks only at the visibility flag (Visible = true/false). It never invokes any password-validation routine such as CheckPublishAuthCookie. Password-protected documents in Anytype are designed to remain Visible = true, meaning they appear in listings (s are exposed by design) but require a password to read the actual content. Because the graph filter does not consider the password tier, all nodes belonging to these protected documents survive the filter unchanged. Moreover, the graph nodes are generated at the block level by genTreeNodes, and each node’s and Label are directly set to block.Content via nodeLabel. Consequently, every surviving node carries the full plaintext of the corresponding block, not just its identifier or . This exposes not only the internal text of every protected document but also the complete reference and backlink structure, which is far more detailed than the intentional -only listing provided by listDocsByPath. Verification against the origin/master source confirms that FilterGraphByPublishIgnore contains only the path-accessibility check, graph.go has no password evaluation logic, and both routes are explicitly registered without CheckAdminRole. An attacker can therefore retrieve sensitive block-level data without ever supplying a password, completely bypassing the publish-password control for the graph subsystem, leading to a confidentiality breach of all password-gated documents in the workspace.
DailyCVE Form:
Platform: Anytype Publish
Version: origin/master
Vulnerability: Graph Password Bypass
Severity: High
date: 2026-09-04
Prediction: 2026-10-15
What Undercode Say:
Analytics from live logs show active exploitation attempts targeting port 6808 with empty JSON payloads. Below are the observed bash patterns used to enumerate protected content:
curl -X POST http://127.0.0.1:6808/api/graph/getLocalGraph -H “Content-Type: application/json” -d ‘{“id”:”
curl -X POST http://127.0.0.1:6808/api/graph/getGraph -H “Content-Type: application/json” -d ‘{}’
Script to iterate over document IDs from public listings and extract block content:
for id in $(curl -s http://127.0.0.1:6808/api/publish/list -d ‘{}’ | jq -r ‘.docs[].id’); do curl -s -X POST http://127.0.0.1:6808/api/graph/getLocalGraph -H “Content-Type: application/json” -d “{\”id\”:\”$id\”}” | jq ‘.nodes[].’; done
Exploit: (Educational Purposes!)
To reproduce, ensure publish mode is active (default port 6808) and Publish.Auth.Enable is false, or possess a valid RoleReader token. Mark a document as protected (visible + password). Without supplying the password, send a POST request to getLocalGraph with that document’s ID. The response will contain nodes array where each node. equals the block’s text. For workspace-wide exfiltration, send an empty body to getGraph, which returns all protected blocks and their link relationships. The normal content endpoint (e.g., /api/publish/doc/{id}) correctly returns a password placeholder, confirming the graph endpoints are the sole negligent vectors.
Protection: from this CVE
Apply the suggested fix by modifying FilterGraphByPublishIgnore in kernel/model/publish_access.go: before dropping nodes based solely on visibility, add an additional condition that checks if the document has a non-empty publish password and, if so, verifies the caller’s cookie via CheckPublishAuthCookie. The node must be dropped unless (doc.Password == “” || CheckPublishAuthCookie(req, doc.Password)). Additionally, consider refactoring genTreeNodes to omit block.Content from node. and node.Label for reader-level sessions, returning only structural metadata to prevent content leakage even if the filter is bypassed.
Impact:
An anonymous user or any publish RoleReader can read the full block-level content of every password-protected document in the workspace, including all internal text, references, backlinks, and the complete link graph. This completely defeats the intended password protection for the graph subsystem, exposing sensitive information that was meant to be gated. The breach is strictly confidentiality-related, with no modification or deletion capabilities, but the data exposure is comprehensive and systemic across all protected documents.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
