CVE-2026-85622

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

Rincian

Terbit di NVD

4 September 2026

Terakhir diubah

10 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/AppFlowy-IO/AppFlowy-Cloud
• https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs
• https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629
• https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket