CVE-2026-85622

6.0 mediumEPSS 0.4%

Medium (6.0). EPSS 0.4% chance of exploitation in the next 30 days.

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-09-04
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://github.com/AppFlowy-IO/AppFlowy-Cloud
https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs
https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629
https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket

Check your stack JSON