CVE-2026-16007: Authenticated SQL Injection in AppFlowy

Published Aug 15, 2026

Updated

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Affected Software

1 affected component

AppFlowy

Event History

Aug 15, 2026

CVE Published

via MITRE·05:21 AM

Data Sourced

via MITRE·05:21 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-16007?

CVE-2026-16007 has a risk score of 50, indicating a moderate severity level.

How do I fix CVE-2026-16007?

To mitigate CVE-2026-16007, ensure to validate and sanitize all user inputs in the qcuiknote feature to prevent SQL injection.

Who is affected by CVE-2026-16007?

Authenticated users of AppFlowy with access to the qcuiknote feature are affected by CVE-2026-16007.

What types of attacks can CVE-2026-16007 facilitate?

CVE-2026-16007 can facilitate SQL injection attacks that allow attackers to exfiltrate sensitive data from the underlying SQL database.

When was CVE-2026-16007 published?

CVE-2026-16007 was published on August 15, 2026.

CVE-2026-16007: Authenticated SQL Injection in AppFlowy

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-16007?

How do I fix CVE-2026-16007?

Who is affected by CVE-2026-16007?

What types of attacks can CVE-2026-16007 facilitate?

When was CVE-2026-16007 published?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-16007?

How do I fix CVE-2026-16007?

Who is affected by CVE-2026-16007?

What types of attacks can CVE-2026-16007 facilitate?

When was CVE-2026-16007 published?