Executive brief
AppFlowy-Cloud is a collaborative workspace platform similar to Notion that stores documents and databases. Version 0.9.64 contains a flaw in its access controls that allows attackers to access and modify other users' documents and data by combining a victim's object ID with their own workspace ID, completely bypassing the intended security boundaries between workspaces.
Technical details
The vulnerability is an authorization bypass in the collab object access control mechanism (libs/access-control/src/casbin/collab.rs). The application fails to verify that requested collab objects actually belong to the workspace being accessed, allowing attackers to supply arbitrary object IDs paired with their own workspace ID to bypass access checks. This affects read, modify, and delete operations on cross-workspace data. The flaw requires an authenticated user with knowledge of a victim's object ID but no special privileges; exploitation is possible over the network by making authenticated API requests. No public exploit code is known to exist, but the vulnerability has a high impact due to cross-workspace data exposure.
Affected products
- AppFlowy-IO AppFlowy-Cloud 0.9.64
Timeline
- 2026-09-04: disclosed: CVE-2026-85619 published