AppFlowy-Cloud vulnerabilities

2 known vulnerabilities in AppFlowy-Cloud from AppFlowy-IO. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  AppFlowy-Cloud: Incorrect Authorization

  CVE-2026-85619Sep 4, 2026AppFlowy-IO

  AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace

• 7.1 High severity

  AppFlowy-Cloud: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-16007Aug 15, 2026AppFlowy-IO

  AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.