Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92788Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
High 8.8
In plain English
A high-severity incorrect authorization in coze-studio from coze-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coze-dev | coze-studio | 0 – through 0.5.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #2710 issue-tracking
- https://github.com/coze-dev/coze-studio product
- only the shape of the table name is validated, not its ownership technical-description
- physical table names are table_<id> from an install-wide generator technical-description
- VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node third-party-advisory