Appflowy-Io Appflowy-Cloud
4 CVEs affecting Appflowy-Io Appflowy-Cloud. Latest disclosed: 2026-09-10. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85619 | High | 7.5 | 2026-09-04 | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and… |
CVE-2026-88898 | Medium | 6.5 | 2026-09-10 | AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to… |
CVE-2026-85622 | Medium | 5.3 | 2026-09-04 | AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowin… |
CVE-2026-16007 | | 2026-08-15 | AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrat… |