SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-85622

MEDIUM · CVSS 5.3 EPSS 0.31% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

AppFlowy-Cloud versions prior to 0.9.64 are vulnerable due to inadequate validation of workspace membership during WebSocket connections, enabling authenticated users to access and manipulate data in workspaces they do not belong to. This flaw allows attackers to exploit sync Manifest messages to read sensitive document or database states from other collaborations, posing a risk to data confidentiality. Organizations using AppFlowy-Cloud should prioritize patching this vulnerability to prevent unauthorized data access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-85622
Severity
MEDIUM
CVSS
5.3
EPSS
0.31%

Original NVD Description

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.