CVE-2026-85619
Last modified
CVE-2026-85619 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud | <= 0.9.64 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-85619?
How severe is CVE-2026-85619?
How do I fix CVE-2026-85619?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-85613OpenPanel before 2.3.0 contains a cross-site scripting vulne…8.2
- CVE-2026-85614OpenPanel before 2.3.0 contains an unauthenticated server-si…8.6
- CVE-2026-85615Openpanel before 2.3.0 contains an insecure direct object re…6.4
- CVE-2026-85616Snipe-IT versions before 8.6.2 contain an authorization bypa…8.5
- CVE-2026-85617snipe-it versions before 8.6.3 contain an authorization bypa…8.8
- CVE-2026-85618ConvertX 0.17.0 contains an arbitrary file read vulnerabilit…6.5
- CVE-2026-8562Side-channel information leakage in Navigation in Google Chr…4.3
- CVE-2026-85620Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vul…8.6
- CVE-2026-85621LobeChat (LobeHub) 2.2.1 does not properly verify inbound ch…6.5
- CVE-2026-85622AppFlowy-Cloud through 0.9.64 fails to validate workspace me…5.3
- CVE-2026-85623goose 1.37.0 executes arbitrary commands from recipe stdio e…8.8
- CVE-2026-85624Blinko 1.8.7 contains a cross-user private note disclosure v…6.5
Are you affected by CVE-2026-85619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST