CVE-2026-77935
Awaiting Analysis Awaiting Analysis - Queue

Insecure Direct Object Reference in Coze Studio Workflows

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-07
NVD
CVE-2026-77935
EUVD
EUVD-2026-104691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
coze-dev coze-studio 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77935 is an Insecure Direct Object Reference (IDOR) vulnerability in Coze Studio through version 0.5.1. It allows authenticated users to access workflows belonging to other spaces by manipulating workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in API routes like save, update_meta, batch_delete, canvas, test_run, and nodeDebug to read, run, overwrite, or delete workflows.

Detection Guidance

To detect this IDOR vulnerability in Coze Studio, monitor API requests to routes like /save, /update_meta, /batch_delete, /canvas, /test_run, and /nodeDebug. Look for requests with mismatched spaceID and workflowID pairs where a user accesses workflows not belonging to their space. Check server logs for unauthorized access attempts or workflow modifications.

Impact Analysis

This vulnerability allows unauthorized users to access, modify, or delete workflows in other spaces. Attackers could steal sensitive data, disrupt operations, or manipulate workflows for malicious purposes. The high CVSS score (8.7) indicates significant risk for affected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules. It may result in data breaches, non-compliance penalties, and loss of trust due to inadequate access controls.

Mitigation Strategies

Immediately update Coze Studio to the latest version beyond 0.5.1. Implement strict input validation to ensure spaceID and workflowID pairs match authorized access. Add server-side permission checks for all workflow-related API routes. Restrict access to sensitive routes like batch_delete and update_meta to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...