CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 contain a missing-authorization flaw (CWE-862): the bulk publish endpoint path does not verify that the caller is authorized for the workspace being targeted. Any authenticated user can invoke bulk publish against a workspace they do not belong to, writing published views with attacker-controlled titles, body content, and metadata into another tenant's workspace. Because those views are published, an attacker can deface victim tenants' public pages or host phishing content on the victim's trusted URLs. Any deployment running the affected versions, including self-hosted instances and potentially the hosted service, is affected. No exploitation has been reported, the issue is not in CISA KEV, and no public proof-of-concept is known; the CVSS 4.0 score of 7.1 (High) reflects high integrity impact with no confidentiality or availability impact.

What to do: Upgrade AppFlowy-Cloud to a release newer than 0.9.64 as soon as a patched version is published (no fixed version is specified in this data, so check upstream releases). Interim mitigations: restrict access to the bulk publish endpoint at the reverse proxy/WAF layer where feasible and verify all published views in your workspaces for unexpected titles, bodies, or metadata. Because the flaw allows cross-tenant writes with no confidentiality impact, also check logs for bulk publish calls from users outside the workspace's membership.