AppFlowy-Cloud EUVD-2026-75543

Exploitation requires a valid authenticated session on the target AppFlowy-Cloud instance - any registered user account on any tenant suffices (PR:L), including a free self-registered account if open registration is enabled. The attacker must know or enumerate the target workspace's namespace identifier, which may be derivable from publicly shared workspace URLs. The bulk publish feature must be available and not independently access-controlled at the network boundary. No special configuration, elevated role, or platform-specific condition is required beyond the default AppFlowy-Cloud deployment for versions 0.7.2 through 0.9.64. Exploitation is bounded: the attacker can only write to published/public view content (VI:H), cannot read private workspace data (VC:N), and cannot disrupt availability (VA:N). Deployments where the publish endpoint is firewalled from untrusted callers or where the publish feature is administratively disabled are not exploitable via this path.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H) correctly characterizes a network-reachable, low-complexity flaw requiring only a valid account, with high integrity impact on victim content - even a mid-sized municipal IT team in radom running a self-hosted AppFlowy-Cloud instance should treat this as urgent given the phishing-hosting angle. The absence of confidentiality (VC:N) and availability (VA:N) impact prevents a critical rating, but the integrity vector is operationally severe for any organization whose public AppFlowy workspace pages are trusted by end users or linked from external sites. A publicly available PoC gist by mtholmquist (referenced in CVE data) significantly lowers the exploitation barrier; no CISA KEV listing means confirmed active exploitation is unverified, but the low attack complexity combined with PoC availability elevates practical risk above what the score alone suggests. EPSS data was not provided; given PoC presence and AC:L, real-world exploitation probability should be assumed elevated for multi-tenant deployments. No CVSS 3.1 vector was provided by the reporter - only the CVSS 4.0 base vector is available for scoring reference.

An attacker registers or already holds a valid account on a multi-tenant AppFlowy-Cloud instance, then enumerates or derives a victim organization's workspace namespace from publicly visible AppFlowy workspace URLs. Using the public PoC, the attacker submits a crafted bulk publish API request specifying the victim workspace path and attacker-controlled page content, causing the victim's trusted public AppFlowy URL to serve a phishing login form or brand-impersonating content to any visitor without the victim organization's knowledge or consent.