CVE-2026-85622: AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to AppFlowy-Cloud, but does not need to be a member of the target workspace. Exploitation also requires knowledge of victim collaboration object identifiers.
What access can an attacker obtain?
An attacker can establish a WebSocket session associated with a workspace they do not belong to and send sync Manifest messages for victim object identifiers. This can expose the full document or database state for collaborations in other workspaces.
Does exploitation require victim interaction?
No. The affected collaboration data can be read without involvement from users in the target workspace.
Which versions are affected?
AppFlowy-Cloud through version 0.9.64 is affected.