CVE-2026-85619 HIGH

CVE-2026-85619: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

Vendor Appflowy-Io

Product AppFlowy-Cloud

Weakness CWE-863 · Incorrect authorization

Published September 4, 2026

Last update September 4, 2026

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.

Key dates

02Disclosure timeline

September 4, 2026 CVE published

September 4, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-85619 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2026-4933 Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029 CVE-2025-9376 Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass CVE-2025-14866 Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011 CVE-2026-3525 File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020