Skip to content
OpenAdvisories

Product · AppFlowy-IO

AppFlowy-Cloud

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-88898

    AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

    AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-c…

    AppFlowy-IO AppFlowy-Cloud
  • Medium 5.3
    CVE-2026-85622

    AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

    AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync …

    AppFlowy-IO AppFlowy-Cloud