Coze Studio EUVD-2026-104691

Requires a valid authenticated account (any low-privilege tenant user) on a Coze Studio instance through version 0.5.1, plus knowledge or enumeration of a target's workflowID. Exploitation is performed against the save, update_meta, batch_delete, canvas, test_run and nodeDebug workflow API routes, where the server trusts the client-supplied workflowID without verifying it belongs to the caller's spaceID. Limiting factors: the attacker must already be authenticated (PR:L) so this is not usable by fully anonymous external attackers; realistic risk is highest on shared or multi-tenant deployments where untrusted users can register, and lower on single-tenant private installations. No user interaction, no special non-default configuration, and no elevated privileges are required beyond basic account access.

This is a genuine, actionable priority rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, which is fully consistent with the description: any authenticated tenant can reference another tenant's workflowID. The 8.7 (High) rating is driven by VC:H/VI:H (full cross-tenant read and overwrite/delete of workflows) with VA:L. Exploitability signals reinforce priority: a public POC/exploit exists (referenced on lasso.security) and the issue was reported by VulnCheck, a credible exploit-intelligence source. Counter-signals and gaps: there is NO EPSS score provided and NO SSVC decision data in the input, so automatability and probability of exploitation cannot be quantified here. The CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation - POC availability must not be conflated with active exploitation. Net: a multi-tenant SaaS/self-hosted platform with a trivially exploitable cross-tenant authorization flaw and public exploit code warrants prompt patching, but the real-world blast radius is bounded by deployment footprint and the requirement that the attacker already hold a valid (low-privilege) account on the instance.

An attacker signs up for or already holds a low-privilege account on a shared Coze Studio instance, then calls workflow API handlers (e.g. canvas or test_run) substituting a victim tenant's workflowID while keeping their own spaceID, reading or executing a competitor's proprietary workflow. By calling save, update_meta or batch_delete the same attacker can overwrite or permanently delete another tenant's workflows. Public exploit code is available (referenced via lasso.security and VulnCheck), lowering the barrier to weaponization.