AppFlowy-IO vulnerabilities
We track 2 vulnerabilities in AppFlowy-IO products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score
Latest AppFlowy-IO vulnerabilities
- 7.5 High severity
AppFlowy-Cloud: Incorrect Authorization
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace
- 7.1 High severity
AppFlowy-Cloud: Improper Neutralization of Special Elements used in an SQL Command
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.