Executive brief
AppFlowy-Cloud is an open-source collaborative workspace and project management platform. The bulk publish endpoint fails to verify that the user belongs to the target workspace, allowing any authenticated user to inject malicious content (with custom titles, body text, and metadata) into other organizations' public pages. Attackers can deface public-facing content or host phishing pages on trusted AppFlowy URLs.
Technical details
This is a missing authorization vulnerability (CWE-862) in the publish_collabs handler in src/api/workspace/publish.rs. The endpoint accepts authenticated requests to publish content but does not call the check_workspace_owner_or_publisher function before writing to the target workspace's public namespace, unlike sibling handlers (unpublish_collabs and patch_collabs) that do enforce this check. An authenticated user only needs knowledge of a victim workspace ID to publish arbitrary content into that workspace's public namespace, where it is served to unauthenticated visitors. The vulnerability affects versions 0.7.2 through 0.9.64; AppFlowy-Cloud was archived on 2026-08-30 with the defect unfixed and no patched version available.
Affected products
- AppFlowy AppFlowy-Cloud 0.7.2 through 0.9.64
Timeline
- 2026-09-10: disclosed: Published to NVD and GitHub Gist after private report received no response
- 2026-08-30: other: AppFlowy-Cloud repository archived with defect unfixed