VULNERABILITY INTELLIGENCE
CVE-2026-85619
CVSS score7.7 HIGH
EPSS probability0.57%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-10
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Weakness classification
- CWE-863: Incorrect Authorization