Advisories · Technology

AppFlowy-IO AppFlowy-Cloud.

Every CVE that names AppFlowy-IO AppFlowy-Cloud among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-88898 CVE record

CVSS 7.1 High

AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
- AppFlowy-IO AppFlowy-Cloud
- Broken access control
Not analysed yet 10 Sept 2026
CVE-2026-85622 CVE record

CVSS 6.0 Medium

AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
- AppFlowy-IO AppFlowy-Cloud
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2026-85619 CVE record

CVSS 7.7 High

AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
- AppFlowy-IO AppFlowy-Cloud
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2026-16007 CVE record

CVSS 7.1 High

Authenticated SQL Injection in AppFlowy
- AppFlowy-IO AppFlowy-Cloud
- SQL injection
Not analysed yet 15 Aug 2026