CyberRota Analysis
AI-GeneratedAppFlowy-Cloud version 0.9.64 contains a vulnerability that allows unauthorized access to documents and database rows across different workspaces due to insufficient authorization checks. Attackers can exploit this flaw by supplying a victim's object ID along with their own workspace ID, enabling them to read, modify, or delete sensitive data. Organizations using this version should prioritize patching to mitigate the risk of data breaches and unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.