CVE-2026-88898
Deferred Deferred - Pending Action

AppFlowy-Cloud Workspace Authorization Bypass in Bulk Publish

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88898
EUVD
EUVD-2026-75543

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
appflowy cloud From 0.7.2 (inc) to 0.9.64 (inc)
appflowy cloud 0.9.64
appflowy appflowy-cloud From 0.7.2 (inc) to 0.9.64 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88898 is a high-severity vulnerability in AppFlowy-Cloud versions 0.7.2 through 0.9.64. It involves a missing authorization check in the bulk publish endpoint, allowing authenticated users to publish content into other tenants' workspaces without proper workspace-level permissions. Attackers can inject malicious content like phishing pages or defaced public pages into victim workspaces.

Detection Guidance

Since AppFlowy-Cloud versions 0.7.2 through 0.9.64 are no longer maintained and the repository is archived, detection relies on verifying software versions. Check installed versions with commands like 'appflowy-cloud --version' or inspect package metadata. Monitor network traffic for unauthorized publish requests to the bulk publish endpoint (/api/workspace/publish). Look for unexpected content in public namespaces or defaced pages.

Impact Analysis

If you use AppFlowy-Cloud versions 0.7.2 to 0.9.64, an attacker with valid credentials could publish unauthorized content into your workspace. This could lead to defacement of public pages, hosting phishing content on trusted URLs, or spreading malware. The impact includes reputational damage, data integrity risks, and potential legal consequences if sensitive data is exposed.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by allowing unauthorized access to or modification of sensitive data in workspaces. GDPR requires strict data access controls, while HIPAA mandates protection against unauthorized data tampering. Exploitation could result in data breaches, unauthorized disclosures, or integrity violations, leading to regulatory penalties.

Mitigation Strategies

Upgrade to AppFlowy Managed Cloud or AppFlowy Self-hosted Cloud as the legacy AppFlowy-Cloud repository is no longer maintained and contains unpatched vulnerabilities.

If using the legacy version, restrict access to the bulk publish endpoint by implementing workspace authorization checks similar to unpublish_collabs and patch_collabs handlers.

Monitor network traffic for unauthorized publishing attempts to public namespaces and review workspace memberships for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart