Coze Studio RCE and IDOR Vulnerabilities

Coze Studio through 0.5.1 exposes cross-tenant workflow access because its workflow API trusts a client-supplied workflowID without verifying that the object belongs to the caller's space. An authenticated low-privilege user who knows or enumerates another tenant's workflowID can pair it with their own spaceID and read, run, overwrite, or delete that workflow via the save, update_meta, batch_delete, canvas, test_run, and nodeDebug routes. Publicly available exploit code exists, and exposure is highest on shared or multi-tenant deployments that allow untrusted users to register, while single-tenant private installations face lower practical risk.

Remote code execution in Coze Studio before 0.5.0 allows any registered user to run arbitrary commands through workflow code nodes because the shipped default CODE_RUNNER_TYPE="local" executes Python in an unsandboxed host subprocess. The regex import filter can be bypassed with __import__('subprocess'), exposing environment variables, model API keys, and connected services including MySQL, MinIO, Redis, and etcd; publicly available exploit code exists. The vendor fix changes the default runner to "sandbox" in 0.5.0, so self-hosted instances that have not overridden the default are the primary exposure.