CVE-2026-77935
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
| CWE | CWE-639 |
| Vendor | coze-dev |
| Product | coze-studio |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for coze-dev coze-studio
Be the first to know when new high vulnerabilities affecting coze-dev coze-studio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
coze-dev / coze-studio
0 ≤ 0.5.1
References
lasso.security: https://www.lasso.security/vulnerability-database/cve-2026-77935 github.com: https://github.com/coze-dev/coze-studio/blob/72cecff858a5a18662c5d9d1a4764c53ebc98317/backend/application/workflow/workflow.go#L303 vulncheck.com: https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-space-workflow-idor-via-workflow-api-handlers
Credits
Noy Pearl Michael Sromin Ophir Dror