Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: AppFlowy-IO Clear all filters
TI-2026-58747 CVE-2026-85622 · GHSA-gjxj-rv8r-wcp5

AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

Priority MEDIUM 60

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00395 Published 2026-09-04 No fix listed CWE-863
TI-2026-58744 CVE-2026-85619 · GHSA-7jw5-c6mp-q4xf

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

Priority HIGH 69

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00567 Published 2026-09-04 No fix listed CWE-863
TI-2026-13403 CVE-2026-16007 · GHSA-jhw3-xg32-wf56

Authenticated SQL Injection in AppFlowy

Priority MEDIUM 64

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00344 Published 2026-08-15 No fix listed CWE-89