CVE-2026-77169: Medium severity workspace app vulnerability
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
Organizations using both the workspace app and the team folders app are exposed where workspace delegates limited team-folder administrative privileges through API/REST. The affected delegation model is intended to restrict an administrator to folders for which they have advanced permissions.
What access does an attacker need?
An attacker needs high privileges: API/REST-only delegated administrator access provided through the workspace app. This is not described as an unauthenticated attack.
Does exploitation require a victim to take an action?
No user interaction is required according to the CVSS vector. The issue is reachable over the network and has low attack complexity.
What is the potential impact?
The vulnerability can lead to high confidentiality and integrity impact by bypassing folder-level authorization controls. No availability impact is indicated.