Description

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:42.003Z",
  "pubdate": "2026-09-04T15:17:42.003Z",
  "executiveSummary": "AppFlowy-Cloud version 0.9.64 suffers from a critical broken object-level authorization (BOLA) vulnerability. The application fails to strictly validate that requested collaborative objects, such as documents or database rows, are cryptographically or logically bound to the user's current workspace session. This failure allows authenticated users to access, modify, or delete sensitive data belonging to other workspaces.\nThe vulnerability stems from improper input validation where the server-side authorization logic relies on user-supplied workspace IDs without verifying the ownership of the associated object IDs. An attacker can manipulate API requests to cross authorization boundaries, effectively escalating privileges to access resources across the entire multi-tenant environment. This poses a significant risk to data confidentiality and integrity, as malicious actors can exfiltrate or corrupt documents and database entries that should be strictly isolated. Exploitation requires minimal effort, as it only involves modifying object references within standard API requests. The impact is severe, potentially leading to unauthorized data exposure and total loss of workspace data isolation within the AppFlowy-Cloud infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) flaw within the AppFlowy-Cloud authorization middleware. In version 0.9.64, the application's backend architecture processes requests to interact with 'collab' objects (the fundamental units of documents and database entries) without enforcing a mandatory relationship check between the provided object identifier and the user's authenticated workspace context.\nWhen an authenticated user initiates a request to retrieve or modify a resource, the application expects an object ID and a workspace ID. The server-side logic checks if the user has access to the workspace ID provided in the request headers or body but fails to confirm that the requested object ID is cryptographically or logically associated with that specific workspace. Consequently, the application assumes that if a user belongs to a workspace, they have valid access to all objects referenced under that workspace scope, regardless of whether the object actually belongs to it.\nThe exploitation flow proceeds as follows: 1) The attacker authenticates to their own legitimate AppFlowy-Cloud workspace. 2) The attacker identifies a target object ID belonging to a separate, victim-controlled workspace (often via reconnaissance or shared links). 3) The attacker crafts an API request targeting the AppFlowy-Cloud backend, substituting their own authorized workspace ID while inserting the victim's object ID into the request body or parameters. 4) The server validates the attacker's presence in their own workspace, ignores the cross-workspace mismatch, and executes the operation on the victim's resource.\nThis vulnerability allows for unauthorized Read (GET), Update (PATCH/PUT), and Delete (DELETE) operations on any collaborative object. Because the system lacks a secondary authorization layer that cross-references the object ownership against the current user's session token permissions, the attack surface extends across all documents and database rows stored in the cloud environment. There is no requirement for administrative privileges; a standard user account is sufficient to perform these cross-tenant data manipulation attacks. The vulnerability is exploitable via standard network protocols over HTTPS, and because it resides in the core business logic of the cloud service, it affects all data managed by the platform until the server-side authorization checks are strictly hardened to enforce object-to-workspace mapping."
}