CVE-2026-85619 Details
Description
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
A vulnerability in AppFlowy-Cloud version 0.9.64 allows authenticated users to bypass authorization checks and access collaborative documents and database rows from other workspaces. The issue arises because the application fails to verify that requested collaboration objects belong to the correct workspace. Attackers can exploit this by supplying a victim's object ID along with their own workspace ID, enabling them to read, modify, or delete cross-workspace data. This flaw is a tenant-isolation failure in the application's collaborative data management.
Collaboration authorization checks should be updated to verify that the object ID belongs to the specified workspace before granting access. Additionally, all storage read operations should be scoped by workspace ID to prevent unauthorized cross-workspace data access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | [email protected] | Source CodeVendor |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs | [email protected] | Source CodeVendor |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/appflowy-cloud-0.9.64-cross-workspace-collab-access-via-http-api | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AppFlowy-Cloud | <= 0.9.64 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |