CVE-2026-77935 — Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplyin…
Published: 2026-10-20 · CVSS: 8.7 · CVSS 4.0
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7