AppFlowy Cloud CVE-2026-16007

Requires a valid AppFlowy Cloud user account (authenticated, PR:L per CVSS 4.0 vector). The qcuiknote feature must be accessible to the authenticated user - this is the specific attack surface and the exploitation is limited to this feature. Attack complexity is low (AC:L) and no special timing, race conditions, or advanced prerequisites apply (AT:N), meaning any authenticated user capable of reaching the qcuiknote endpoint can exploit this using publicly documented SQL injection techniques. Factors limiting exploitation: unauthenticated external attackers cannot exploit this without first obtaining credentials; integrity impact is low (VI:L), suggesting write capability is constrained; there is no availability impact (VA:N); scope is bounded to the vulnerable system with no lateral movement to subsequent systems (SC/SI/SA all N).

The CVSS 4.0 vector places this at medium-high severity (7.1) with low attack complexity and no special conditions beyond holding a valid user account. The most significant risk amplifier is the publicly available proof-of-concept exploit published by Project Black - transitioning this from a theoretical flaw to one any authenticated user could weaponize using publicly documented techniques. No EPSS score was provided and the vulnerability does not appear in the CISA KEV catalog, suggesting exploitation has not yet been confirmed at scale; however, the absence of KEV listing should not be read as low urgency given the public PoC and the absence of a patch. The scope change metrics (SC/SI/SA all N) indicate blast radius is contained to the AppFlowy Cloud system itself. Risk is highest for multi-tenant deployments where a low-privilege attacker could exfiltrate data belonging to other users or administrators. No conflicting signals were present - the CVSS vector is consistent with the described attack scenario.

An attacker obtains or already possesses a valid AppFlowy Cloud account at any privilege level. They navigate to the qcuiknote feature and submit a crafted input payload containing SQL metacharacters that break the intended query boundary, appending a UNION-based or stacked query. The injected SQL executes server-side, returning contents of arbitrary database tables - including other users' workspace data, session tokens, or credentials - to the attacker. A public proof-of-concept published by Project Black confirms this attack path is reproducible.