CVE-2026-85622CWE-863broken-access-control

CVE-2026-85622

Medium · published September 4, 2026

CVSS v3.1

5.3

EPSS

Percentile

32.5

In the wild

Unconfirmed

What it is

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 6.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00395 · 32.5th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-09-04T19:17Z

References (4)

https://github.com/AppFlowy-IO/AppFlowy-Cloud · [email protected]https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs · [email protected]https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629 · [email protected]https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket · [email protected]

EPSS history

Timeline

06 SEP 03:33Z
EPSS moved — → 0%
epss
04 SEP 14:32Z
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
cvelistv5