Quick answers
- Is CVE-2026-92788 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92788 being exploited in the wild.
- How severe is CVE-2026-92788?
- High severity, with a CVSS score of 8.8, published 16 September 2026.
- Which products and versions are affected?
- Coze Studio through 0.5.1.
- Is there a fix for CVE-2026-92788?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92788 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92788?
- Check whether you run Coze Studio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a cross-workspace access control bypass affecting the memory database (SQL customization nodes) in Coze Studio. The vulnerable component in backend/domain/memory/database/service fails to validate that table names used in SQL queries belong to the caller's workspace before executing them. An authenticated attacker can enumerate predictable table identifiers and execute SQL SELECT, INSERT, or DELETE statements against other workspaces' memory databases. The attack requires valid authentication but no special privileges; table IDs are guessable/enumerable. Patches should be applied to enforce workspace isolation checks before executing custom SQL.
Affected products
- Coze Coze Studio through 0.5.1
Timeline
- 2026-09-16: disclosed