AppFlowy-Cloud CVE-2026-85622

Exploitation requires a valid authenticated account on the target AppFlowy-Cloud instance (PR:L) - unauthenticated access is not possible. Beyond authentication, the attacker must know or enumerate target workspace identifiers and victim document or database object identifiers, which are instance-specific UUIDs not publicly discoverable without prior access or information leakage; this elevates attack complexity to AC:H. The vulnerable handler (establish_ws_connection_v2) is active in all standard AppFlowy-Cloud deployments through 0.9.64 with no special configuration required to expose the flaw. Exploitation is limited to confidentiality - no write, delete, or availability impact is possible through this vector. Multi-tenant deployments with mixed-trust users (e.g., SaaS-style shared instances or internal platforms with external contributors) carry the highest practical risk; single-team deployments where all registered users are trusted present minimal real-world exposure.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:H/AT:P/PR:L/UI:N/VC:H accurately captures the key risk modifiers: the attack is network-reachable, requires an authenticated account (PR:L), and is constrained by the need to know or enumerate valid workspace and object identifiers (AC:H) in addition to a specific precondition of account existence on the same instance (AT:P). The confidentiality impact is high (VC:H) - full document and database state - with no integrity or availability component. EPSS data is not provided, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. Despite the moderate composite score, the practical risk in multi-tenant or shared self-hosted deployments is meaningful: even a mid-sized municipal IT team in swidnica that uses AppFlowy-Cloud for internal project collaboration should treat this as urgent given that sensitive documents are fully readable by any other platform account holder. In tightly controlled single-organization deployments with trusted users, the attack surface is substantially reduced.

An attacker with a valid account on a shared AppFlowy-Cloud instance enumerates or infers workspace UUIDs and document/database object identifiers belonging to other workspaces, potentially via prior platform interaction or API reconnaissance. The attacker then opens a WebSocket connection to the establish_ws_connection_v2 endpoint specifying a target workspace ID - the server binds the session without membership verification. By sending sync Manifest messages referencing victim document or database IDs, the attacker receives complete collaboration object state, including all document content and database records, without any action required from legitimate workspace members.