Description
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud | ≤ 0.9.64 | — |
References
- GitHub Issue #1624 issue-tracking
- https://github.com/AppFlowy-IO/AppFlowy-Cloud product
- https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs technical-description
- VulnCheck Advisory: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API third-party-advisory