Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-77935Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers

High 8.3

In plain English

A high-severity authorization bypass via user-controlled key in coze-studio from coze-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 64.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

Affected products (as reported)

Vendor	Product	Versions
coze-dev	coze-studio	0 – through 0.5.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

Lasso.security Advisory technical-description, exploit
https://github.com/coze-dev/coze-studio/blob/72cecff858a5a18662c5d9d1a4764c53ebc98317/backend/application/workflow/workflow.go#L303 technical-description
VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers third-party-advisory