CVE-2026-85619 — AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows acr…
Published: 2026-09-04 · CVSS: 7.7 · CVSS 4.0
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7