CVE-2026-92788CWE-863broken-access-control

CVE-2026-92788

High · published September 17, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-17T01:17Z
References (5)
https://github.com/coze-dev/coze-studio · [email protected]https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/memory/database/service/database_impl.go#L2203-L2250 · [email protected]https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/infra/rdb/impl/rdb/mysql.go#L825-L830 · [email protected]https://github.com/coze-dev/coze-studio/issues/2710 · [email protected]https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-tenant-database-access-via-workflow-sql-node · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
    cvelistv5