Authorization Bypass in AppFlowy-Cloud Affects Multiple Workspaces

CVE-2026-85619

What is CVE-2026-85619?

The AppFlowy-Cloud application version 0.9.64 demonstrates a critical flaw in its authorization mechanism, specifically failing to verify that requested collaborative objects are tied to the respective user’s workspace. An attacker can manipulate a victim's object ID and their own workspace ID, leading to unauthorized access that allows them to read, modify, or delete sensitive data and documents belonging to different workspaces. This poses significant data security risks to organizations relying on AppFlowy-Cloud for collaborative work.

References