Search
Find a vulnerability
Search criteria
6 vulnerabilities by AppFlowy-IO
CVE-2026-85622 (GCVE-0-2026-85622)
Vulnerability from nvd – Published: 2026-09-04 14:32 – Updated: 2026-09-04 15:40
VLAI
EPSS
VEX
Title
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
Summary
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 15:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-07-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85622",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T15:39:45.690714Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:40:12.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:13.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1629",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket"
}
],
"title": "AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85622",
"datePublished": "2026-09-04T14:32:13.299Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T15:40:12.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85619 (GCVE-0-2026-85619)
Vulnerability from nvd – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:56
VLAI
EPSS
VEX
Title
AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
Summary
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-06-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85619",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:55:50.046578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:56:11.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim\u0027s object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:11.220Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1624",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-0.9.64-cross-workspace-collab-access-via-http-api"
}
],
"title": "AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85619",
"datePublished": "2026-09-04T14:32:11.220Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T17:56:11.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16007 (GCVE-0-2026-16007)
Vulnerability from nvd – Published: 2026-08-15 05:21 – Updated: 2026-08-17 19:47
VLAI
EPSS
VEX
Title
Authenticated SQL Injection in AppFlowy
Summary
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:47 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://projectblack.io/blog/appflowy-authenticat… | exploitthird-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16007",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:47:23.526162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:47:38.040Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AppFlowy\u0027s qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database."
}
],
"value": "AppFlowy\u0027s qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T05:21:17.372Z",
"orgId": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a",
"shortName": "PRJBLK"
},
"references": [
{
"tags": [
"exploit",
"third-party-advisory"
],
"url": "https://projectblack.io/blog/appflowy-authenticated-sql-injection/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated SQL Injection in AppFlowy",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a",
"assignerShortName": "PRJBLK",
"cveId": "CVE-2026-16007",
"datePublished": "2026-08-15T05:21:17.372Z",
"dateReserved": "2026-07-17T05:03:34.369Z",
"dateUpdated": "2026-08-17T19:47:38.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85622 (GCVE-0-2026-85622)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 15:40
VLAI
EPSS
VEX
Title
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
Summary
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 15:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-07-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85622",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T15:39:45.690714Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:40:12.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:13.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1629",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket"
}
],
"title": "AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85622",
"datePublished": "2026-09-04T14:32:13.299Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T15:40:12.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85619 (GCVE-0-2026-85619)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:56
VLAI
EPSS
VEX
Title
AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
Summary
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-06-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85619",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:55:50.046578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:56:11.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim\u0027s object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:11.220Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1624",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-0.9.64-cross-workspace-collab-access-via-http-api"
}
],
"title": "AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85619",
"datePublished": "2026-09-04T14:32:11.220Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T17:56:11.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16007 (GCVE-0-2026-16007)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:21 – Updated: 2026-08-17 19:47
VLAI
EPSS
VEX
Title
Authenticated SQL Injection in AppFlowy
Summary
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:47 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://projectblack.io/blog/appflowy-authenticat… | exploitthird-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16007",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:47:23.526162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:47:38.040Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AppFlowy\u0027s qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database."
}
],
"value": "AppFlowy\u0027s qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T05:21:17.372Z",
"orgId": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a",
"shortName": "PRJBLK"
},
"references": [
{
"tags": [
"exploit",
"third-party-advisory"
],
"url": "https://projectblack.io/blog/appflowy-authenticated-sql-injection/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated SQL Injection in AppFlowy",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a",
"assignerShortName": "PRJBLK",
"cveId": "CVE-2026-16007",
"datePublished": "2026-08-15T05:21:17.372Z",
"dateReserved": "2026-07-17T05:03:34.369Z",
"dateUpdated": "2026-08-17T19:47:38.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}