Coze Studio EUVD-2026-81051

Requires an authenticated Coze Studio account (PR:L) on a multi-tenant/multi-workspace deployment and use of the workflow SQL customization node feature. The attacker must enumerate predictable table identifiers belonging to other workspaces; exploitation succeeds because the workflow SQL node never validates that referenced table names belong to the caller's workspace. Limiting factors: valid low-privilege credentials are needed, the target must run Coze Studio 0.5.1 or earlier with multiple workspaces/tenants sharing the memory-database backend, and impact is confined to other workspaces' memory databases (read/insert/delete). Single-tenant or single-workspace deployments have little to steal via this path.

This is a genuine authenticated cross-tenant authorization flaw (CWE-863), not a high-CVSS-but-low-risk item, though its severity is bounded by prerequisites. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L) - i.e. any valid Coze Studio account. Full CIA impact on the vulnerable system is asserted because an attacker can read, insert, AND delete data in other workspaces' memory databases. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so exploitation status is 'no public exploit identified at time of analysis'; the absence of EPSS/KEV suggests no confirmed widespread exploitation, consistent with a self-hosted niche product recently disclosed by VulnCheck. Note VulnCheck kept subsequent-system metrics at N (SC:N/SI:N/SA:N) even though this is fundamentally a cross-tenant/multi-workspace boundary violation - arguably a scope-changing condition; this is a defensible but conservative scoping choice. Key limiter: the attacker must first hold an authenticated account and must enumerate predictable table identifiers, so it is a privilege-escalation-across-tenants issue rather than a fully unauthenticated internet-facing RCE.

An attacker who registers or already holds a low-privilege account on a multi-tenant Coze Studio instance creates a workflow containing a SQL customization node and references table identifiers belonging to another workspace. Because table names are predictable and never checked against the caller's workspace, the attacker enumerates other tenants' memory-database tables and runs SELECT/INSERT/DELETE statements against them, reading or destroying other customers' data. No public proof-of-concept is referenced, but the root-cause code paths (database_impl.go and mysql.go) are cited in the advisory.