CVE-2026-85622 Details

A vulnerability in AppFlowy Cloud versions through 0.9.64 allows authenticated users to access collaboration data from other workspaces via WebSocket connections. The issue arises because the application fails to verify workspace membership when establishing these connections, particularly in the 'establish_ws_connection_v2' handler. As a result, users can bind their sessions to workspaces they do not belong to and send synchronization messages that exploit this oversight, reading full document or database states from collaborations in other workspaces without involving the actual users.

To address this vulnerability, it is recommended to implement a membership verification step in the 'establish_ws_connection_v2' handler, ensuring that users can only bind sessions to workspaces they are members of. Additionally, the collaboration authorization process should be updated to consider object identifiers, so that access controls are enforced based on both workspace and object membership, closing the vulnerability on both WebSocket and HTTP paths.