Executive brief
Coze Studio is an AI agent development platform that allows users to create and manage workflows with custom SQL queries. A flaw in the platform fails to validate that SQL queries are restricted to the user's own workspace, allowing authenticated attackers to read, modify, or delete data from other users' databases by guessing predictable table identifiers.
Technical details
This is a cross-workspace access control bypass affecting the memory database (SQL customization nodes) in Coze Studio. The vulnerable component in backend/domain/memory/database/service fails to validate that table names used in SQL queries belong to the caller's workspace before executing them. An authenticated attacker can enumerate predictable table identifiers and execute SQL SELECT, INSERT, or DELETE statements against other workspaces' memory databases. The attack requires valid authentication but no special privileges; table IDs are guessable/enumerable. Patches should be applied to enforce workspace isolation checks before executing custom SQL.
Affected products
- Coze Coze Studio through 0.5.1
Timeline
- 2026-09-16: disclosed