CVE-2026-85622
Received Received - Intake

WebSocket Session Hijacking in AppFlowy-Cloud

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85622
EUVD
EUVD-2026-71229

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
appflowy cloud to 0.9.64 (inc)
appflowy cloud 0.9.64

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85622 is an incorrect authorization vulnerability in AppFlowy-Cloud versions up to 0.9.64. The flaw occurs in the WebSocket connection handler where the application fails to validate if a user belongs to a specific workspace before establishing a session. This allows authenticated users to bind their sessions to workspaces they do not have access to.

Detection Guidance

To detect this vulnerability, monitor WebSocket traffic for unauthorized workspace bindings or Manifest sync messages with victim object IDs. Check logs for users accessing workspaces they don't belong to. Use network monitoring tools to inspect WebSocket connections for suspicious activity in AppFlowy-Cloud versions up to 0.9.64.

Impact Analysis

An attacker can exploit this vulnerability by sending specially crafted sync Manifest messages containing victim object identifiers. This enables them to read the full document or database state from collaborative workspaces without any interaction from the victim. The impact includes unauthorized access to sensitive data in other workspaces.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized data exposure risks non-compliance with these regulations, potentially resulting in legal and financial penalties.

Mitigation Strategies

Upgrade AppFlowy-Cloud to a patched version beyond 0.9.64. Implement strict workspace membership validation during WebSocket connection binding. Ensure collaboration authorization checks are object-aware to verify object IDs belong to the correct workspace. Disable WebSocket connections for untrusted users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart