Anyquery versions 0.4.3 and below are susceptible to an authentication bypass that permits unauthorized access to sensitive private integration data.

This vulnerability involves improper authentication and exposure of sensitive information, where an attacker with local access can interact with the anyquery HTTP server without authentication to retrieve private data.

The exploitation of this vulnerability leads to the exposure of sensitive integration data, such as emails, which can result in significant data breaches and a loss of confidentiality. With a CVSS score of 7.7, this is considered a high-severity issue that poses a substantial risk to internal system security and organizational privacy.

Immediate Action: Update the anyquery software to version 0.4.4 or later to resolve the authentication flaw.

Proactive Monitoring: Review system access logs for unauthorized connections to the anyquery HTTP server port from local processes or users.

Compensating Controls: Restrict access to the anyquery port at the host level using firewall rules to ensure only authorized local services can communicate with the interface.

Public Exploit Available: No (exploit_available: unknown)

Given the ability for unauthorized local actors to exfiltrate private integration data, administrators must prioritize upgrading to version 0.4.4 immediately. Securing the local interface is essential to preventing lateral movement and data theft within environments where anyquery is deployed.