Skip to content
OpenAdvisories

Product · AppFlowy-IO

AppFlowy-Cloud

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-85619

    AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

    AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace…

    AppFlowy-IO AppFlowy-Cloud
  • High 7.1
    CVE-2026-16007

    Authenticated SQL Injection in AppFlowy

    AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

    AppFlowy-IO AppFlowy-Cloud