CVE-2026-85619

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

7.7 High

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.57%Unchanged since Sep 5, 2026

What each source reports

CVE List Score used 7.7

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

Record: CVE-2026-85619
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-71226 7.7

Record: EUVD-2026-71226
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7jw5-c6mp-q4xf 7.7

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in...

Record: GHSA-7jw5-c6mp-q4xf
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

NVD 7.7

Record: CVE-2026-85619
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

OSV 7.7

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

Record: CVE-2026-85619
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

appflowy-io appflowy-cloud

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-85619 is a high vulnerability (CVSS 7.7) in Appflowy-io Appflowy-cloud, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. No source names a fixed version.