Description

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T15:17:42.447Z",
  "pubdate": "2026-09-04T15:17:42.447Z",
  "executiveSummary": "The vulnerability identified in AppFlowy-Cloud up to version 0.9.64 concerns a critical flaw in the authorization logic governing WebSocket communication. Specifically, the system fails to perform server-side validation of workspace membership during the establishment of connections via the 'establish_ws_connection_v2' handler.\nThis authorization bypass allows an authenticated user to bind their active session to any arbitrary workspace identifier, regardless of their actual membership or permission status. Consequently, an attacker can gain unauthorized access to private data stored within restricted collaborative environments.\nThe impact is significant, as it facilitates unauthorized disclosure of full document and database states, including sensitive organizational or user-specific content. The vulnerability necessitates that an attacker possess a valid platform account to initiate the connection; however, no interaction is required from the target user or the administrator of the compromised workspace.\nThe risk is categorized as high due to the lack of verification mechanisms, which effectively subverts the isolation boundaries expected in a multi-tenant collaborative cloud architecture. Exploitation is remote and requires only knowledge of the target object identifiers to initiate synchronization requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation logic within the AppFlowy-Cloud backend, specifically in the 'establish_ws_connection_v2' handler. While the handler processes the initial WebSocket upgrade, it neglects to verify if the authenticated user associated with the request possesses valid membership credentials for the requested workspace identifier provided in the connection parameters.\nUnder normal operating conditions, the WebSocket connection sequence should strictly enforce an access control check against a database or authorization provider to confirm that the user_id mapped to the session token is linked to the workspace_id identified in the handshake.\nThe exploitation flow begins when an attacker, possessing a valid session token, initiates a WebSocket connection request to the server. By manipulating the parameters passed to the 'establish_ws_connection_v2' handler, the attacker specifies a workspace_id belonging to a target victim. Because the handler trusts the provided identifier without performing an identity-to-resource mapping check, it successfully binds the attacker's session to the unauthorized workspace context.\nOnce the malicious session is bound, the attacker utilizes the application's synchronization protocol to transmit a 'sync Manifest' message. This message type is intended to initiate data reconciliation between the client and the server. By embedding specific victim object identifiers within the manifest request, the attacker triggers the server to fetch and stream the requested document or database states from the unauthorized workspace directly to the attacker’s WebSocket client.\nThis process bypasses the intended multi-tenancy isolation model, as the server treats the attacker as an authorized member of the target workspace for the duration of the session. The vulnerability effectively turns the synchronization mechanism into a data exfiltration vector. The attack is entirely passive from the victim’s perspective, as the server-side logic provides the data stream without requiring any external authorization or victim intervention.\nThe failure persists across all versions of AppFlowy-Cloud up to and including 0.9.64. The flaw is inherent in the design of the connection handler and impacts the integrity of the entire collaborative environment by exposing arbitrary private object states to any authenticated user."
}