# CVE-2026-85619: AppFlowy-Cloud authorization bypass in collab object access control

Source: https://junglewise.ai/threats/cve-2026-85619-appflowy-cloud-authorization-bypass-in-collab-object-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85619 · Severity: high · CVSS 7.5 · Published 2026-09-04

AppFlowy-Cloud is a collaborative workspace platform similar to Notion that stores documents and databases. Version 0.9.64 contains a flaw in its access controls that allows attackers to access and modify other users' documents and data by combining a victim's object ID with their own workspace ID, completely bypassing the intended security boundaries between workspaces.

Technologies: [AppFlowy-IO AppFlowy-Cloud](https://junglewise.ai/threats/technologies/appflowy-cloud). Vendors: [AppFlowy-IO](https://junglewise.ai/threats/vendors/appflowy-io).

## Quick answers

**Is CVE-2026-85619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85619 being exploited in the wild.

**How severe is CVE-2026-85619?** High severity, with a CVSS score of 7.5, published 4 September 2026.

**Which products and versions are affected?** AppFlowy-IO AppFlowy-Cloud 0.9.64.

**Is there a fix for CVE-2026-85619?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85619 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-85619?** Check whether you run AppFlowy-IO AppFlowy-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the collab object access control mechanism (libs/access-control/src/casbin/collab.rs). The application fails to verify that requested collab objects actually belong to the workspace being accessed, allowing attackers to supply arbitrary object IDs paired with their own workspace ID to bypass access checks. This affects read, modify, and delete operations on cross-workspace data. The flaw requires an authenticated user with knowledge of a victim's object ID but no special privileges; exploitation is possible over the network by making authenticated API requests. No public exploit code is known to exist, but the vulnerability has a high impact due to cross-workspace data exposure.

## Affected products

- AppFlowy-IO AppFlowy-Cloud 0.9.64

## Timeline

- 2026-09-04: disclosed: CVE-2026-85619 published

## References

- [https://github.com/AppFlowy-IO/AppFlowy-Cloud](https://github.com/AppFlowy-IO/AppFlowy-Cloud)
- [https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs](https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs)

## Related threats

- [AppFlowy-Cloud workspace membership validation bypass in WebSocket connections](https://junglewise.ai/threats/cve-2026-85622-appflowy-cloud-workspace-membership-validation-bypass-in)