CVE-2026-85619: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-level privileges in AppFlowy-Cloud and must be able to make HTTP API requests. Exploitation also requires a victim collab object ID, which the attacker supplies together with their own workspace ID.
What data or actions can be exposed across workspaces?
An attacker can bypass workspace authorization for collab objects and access documents and database rows belonging to other workspaces. The reported impact includes reading, modifying, and deleting cross-workspace data.
How can teams determine whether they are affected?
Deployments running AppFlowy-Cloud 0.9.64 are identified as affected. Review HTTP API activity for requests where the workspace ID does not match the workspace that owns the requested collab object, particularly requests that access, update, or delete documents or database rows.