CVE-2026-85622
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.
| CWE | CWE-863 |
| Vendor | appflowy-io |
| Product | appflowy-cloud |
| Published | Sep 4, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for appflowy-io appflowy-cloud
Be the first to know when new medium vulnerabilities affecting appflowy-io appflowy-cloud are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
AppFlowy-IO / AppFlowy-Cloud
0 ≤ 0.9.64
References
github.com: https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629 github.com: https://github.com/AppFlowy-IO/AppFlowy-Cloud github.com: https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs vulncheck.com: https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket
Credits
George Chen