Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-127203

AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type

AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Appflowy-io
Products
Appflowy-cloud
CVE-2026-88898

AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Appflowy-io
Products
Appflowy-cloud
CVE-2026-85619

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Appflowy-io
Products
Appflowy-cloud
CVE-2026-85622

AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Appflowy-io
Products
Appflowy-cloud
CVE-2026-16007

Authenticated SQL Injection in AppFlowy

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Appflowy-io
Products
Appflowy-cloud