EUVD-2026-75543
GHSA-8p2p-fv97-r9ww
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint (AV:N, AC:L) requires a valid account (PR:L); cross-tenant write scopes impact beyond the attacker's own tenant (S:C), driving I:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.
AnalysisAI
Cross-tenant authorization bypass in AppFlowy-Cloud 0.7.2 through 0.9.64 allows any authenticated user to publish arbitrary content into another tenant's workspace namespace via the unguarded bulk publish endpoint. The flaw stems from missing workspace membership validation in the publish path (src/biz/workspace/publish.rs), enabling horizontal privilege escalation across tenant boundaries - attackers can inject attacker-controlled titles, body text, and metadata into victim organizations' public workspace URLs to stage phishing pages or deface legitimate content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the target AppFlowy-Cloud instance - any registered user account on any tenant suffices (PR:L), including a free self-registered account if open registration is enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H) correctly characterizes a network-reachable, low-complexity flaw requiring only a valid account, with high integrity impact on victim content - even a mid-sized municipal IT team in radom running a self-hosted AppFlowy-Cloud instance should treat this as urgent given the phishing-hosting angle. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade AppFlowy-Cloud to a version beyond 0.9.64 once a patched release is published; monitor the upstream GitHub repository at https://github.com/AppFlowy-IO/AppFlowy-Cloud for a tagged release that adds workspace membership authorization in the bulk publish endpoint handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all AppFlowy-Cloud instances running versions 0.7.2 through 0.9.64 and restrict access to the bulk publish API endpoint using network controls or Web Application Firewall rules if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Appflowy Cloud
View allCross-workspace IDOR authorization bypass in AppFlowy-Cloud 0.9.64 allows authenticated users to read, modify, or delete
SQL injection in AppFlowy Cloud's qcuiknote feature enables authenticated users to exfiltrate arbitrary data from the un
Cross-workspace data exfiltration in AppFlowy-Cloud through 0.9.64 allows authenticated users to read documents and data
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today