CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/mtholmquist/ab550712a4628c7c7c4705bceccd93b3
https://github.com/AppFlowy-IO/AppFlowy-Cloud
https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/workspace.rs
https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/biz/workspace/publish.rs
https://www.vulncheck.com/advisories/appflowy-cloud-0.7.2-through-0.9.64-missing-workspace-authorization-on-bulk-publish-endpoint

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-10 15:17

Updated : 2026-09-10 16:18

NVD link : CVE-2026-88898

Mitre link : CVE-2026-88898

CVE.ORG link : CVE-2026-88898

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-88898", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88898", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T14:58:59.102458Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "AppFlowy-IO", "product": "AppFlowy-Cloud", "versions": [{"status": "affected", "version": "0.7.2", "versionType": "custom", "lessThanOrEqual": "0.9.64"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-10T15:17:59.107", "references": [{"url": "https://gist.github.com/mtholmquist/ab550712a4628c7c7c4705bceccd93b3", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/workspace.rs", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/biz/workspace/publish.rs", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/appflowy-cloud-0.7.2-through-0.9.64-missing-workspace-authorization-on-bulk-publish-endpoint", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs."}], "lastModified": "2026-09-10T16:18:11.997", "sourceIdentifier": "disclosure@vulncheck.com"}