Coze Studio
Monthly
Coze Studio through 0.5.1 exposes cross-tenant workflow access because its workflow API trusts a client-supplied workflowID without verifying that the object belongs to the caller's space. An authenticated low-privilege user who knows or enumerates another tenant's workflowID can pair it with their own spaceID and read, run, overwrite, or delete that workflow via the save, update_meta, batch_delete, canvas, test_run, and nodeDebug routes. Publicly available exploit code exists, and exposure is highest on shared or multi-tenant deployments that allow untrusted users to register, while single-tenant private installations face lower practical risk.
Remote code execution in Coze Studio before 0.5.0 allows any registered user to run arbitrary commands through workflow code nodes because the shipped default CODE_RUNNER_TYPE="local" executes Python in an unsandboxed host subprocess. The regex import filter can be bypassed with __import__('subprocess'), exposing environment variables, model API keys, and connected services including MySQL, MinIO, Redis, and etcd; publicly available exploit code exists. The vendor fix changes the default runner to "sandbox" in 0.5.0, so self-hosted instances that have not overridden the default are the primary exposure.
Server-side request forgery in Coze Studio through version 0.5.1 allows an authenticated user who can register or configure a plugin tool to supply an arbitrary server URL, causing the backend to issue HTTP requests to internal-only destinations on the attacker's behalf. The primary risk is confidentiality rather than code execution: responses from cloud metadata endpoints (for example 169.254.169.254) or other services reachable only from the backend network can be read back through the plugin mechanism, potentially exposing credentials, tokens, and internal service data. The issue is rated 7.1 in the CVSS 4.0 vector published with the CVE, while the independent assessment scores it as a credentialed SSRF (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact; no public exploit code was identified at time of analysis and no CISA KEV listing applies, so this is a moderate-priority, credentialed SSRF rather than a critical remote-takeover flaw.
Improper authorization in Coze Studio through 0.5.1 lets an authenticated user (CVSS PR:L) abuse the workflow SQL customization node to reach memory-database tables belonging to other workspaces, because referenced table names are never validated against the caller's own workspace. By enumerating predictable table identifiers, the attacker can read, insert, or delete data in another tenant's memory database, yielding high confidentiality and integrity impact within the affected multi-tenant deployment (our assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires valid low-privilege credentials and a deployment hosting multiple workspaces on a shared memory-database backend; single-tenant installations have little to expose via this path. No public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation.
SQL injection in ByteDance coze-studio up to version 0.5.1 allows authenticated remote attackers to manipulate the ExecuteSQL function in the databaseTool component, enabling arbitrary SQL query execution with limited confidentiality and integrity impact. The vulnerability has a publicly available exploit and affects the backend database service layer; the vendor has not responded to disclosure efforts.
Coze Studio through 0.5.1 exposes cross-tenant workflow access because its workflow API trusts a client-supplied workflowID without verifying that the object belongs to the caller's space. An authenticated low-privilege user who knows or enumerates another tenant's workflowID can pair it with their own spaceID and read, run, overwrite, or delete that workflow via the save, update_meta, batch_delete, canvas, test_run, and nodeDebug routes. Publicly available exploit code exists, and exposure is highest on shared or multi-tenant deployments that allow untrusted users to register, while single-tenant private installations face lower practical risk.
Remote code execution in Coze Studio before 0.5.0 allows any registered user to run arbitrary commands through workflow code nodes because the shipped default CODE_RUNNER_TYPE="local" executes Python in an unsandboxed host subprocess. The regex import filter can be bypassed with __import__('subprocess'), exposing environment variables, model API keys, and connected services including MySQL, MinIO, Redis, and etcd; publicly available exploit code exists. The vendor fix changes the default runner to "sandbox" in 0.5.0, so self-hosted instances that have not overridden the default are the primary exposure.
Server-side request forgery in Coze Studio through version 0.5.1 allows an authenticated user who can register or configure a plugin tool to supply an arbitrary server URL, causing the backend to issue HTTP requests to internal-only destinations on the attacker's behalf. The primary risk is confidentiality rather than code execution: responses from cloud metadata endpoints (for example 169.254.169.254) or other services reachable only from the backend network can be read back through the plugin mechanism, potentially exposing credentials, tokens, and internal service data. The issue is rated 7.1 in the CVSS 4.0 vector published with the CVE, while the independent assessment scores it as a credentialed SSRF (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact; no public exploit code was identified at time of analysis and no CISA KEV listing applies, so this is a moderate-priority, credentialed SSRF rather than a critical remote-takeover flaw.
Improper authorization in Coze Studio through 0.5.1 lets an authenticated user (CVSS PR:L) abuse the workflow SQL customization node to reach memory-database tables belonging to other workspaces, because referenced table names are never validated against the caller's own workspace. By enumerating predictable table identifiers, the attacker can read, insert, or delete data in another tenant's memory database, yielding high confidentiality and integrity impact within the affected multi-tenant deployment (our assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires valid low-privilege credentials and a deployment hosting multiple workspaces on a shared memory-database backend; single-tenant installations have little to expose via this path. No public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation.
SQL injection in ByteDance coze-studio up to version 0.5.1 allows authenticated remote attackers to manipulate the ExecuteSQL function in the databaseTool component, enabling arbitrary SQL query execution with limited confidentiality and integrity impact. The vulnerability has a publicly available exploit and affects the backend database service layer; the vendor has not responded to disclosure efforts.