Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85622AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

Medium 5.3

In plain English

A medium-severity incorrect authorization in AppFlowy-Cloud from AppFlowy-IO. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

Affected products (as reported)

Vendor	Product	Versions
AppFlowy-IO	AppFlowy-Cloud	0 – through 0.9.64

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #1629 issue-tracking
https://github.com/AppFlowy-IO/AppFlowy-Cloud product
https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs technical-description
VulnCheck Advisory: AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket third-party-advisory