Medium severity6.5NVD Advisory· Published Sep 10, 2026· Updated Sep 10, 2026
CVE-2026-88898
CVE-2026-88898
Description
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: 0.7.2-0.9.64
Patches
Vulnerability mechanics
References
4- gist.github.com/mtholmquist/ab550712a4628c7c7c4705bceccd93b3nvd
- github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/workspace.rsnvd
- github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/biz/workspace/publish.rsnvd
- www.vulncheck.com/advisories/appflowy-cloud-0.7.2-through-0.9.64-missing-workspace-authorization-on-bulk-publish-endpointnvd
News mentions
0No linked articles in our index yet.