CVE-2026-85619: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-10
Weakness: CWE-863

Description

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.

Affected products

AppFlowy-IO AppFlowy-Cloud: through 0.9.64

References

https://github.com/AppFlowy-IO/AppFlowy-Cloud
https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs
https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624
https://www.vulncheck.com/advisories/appflowy-cloud-0.9.64-cross-workspace-collab-access-via-http-api
https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624

Get alerted when CVE-2026-85619 or the next vulnerability affects your stack