CVE-2026-16007 is a SQL injection vulnerability affecting the qcuiknote feature of AppFlowy-Cloud. Authenticated users with access to this feature can exploit improper neutralization of special elements in SQL commands to execute arbitrary SQL queries. This vulnerability allows attackers to exfiltrate data from the underlying SQL database. The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no user interaction, and low privileges required. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation is the responsibility of the user or administrator.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the SQL database underlying the qcuiknote feature. Since the attacker must be authenticated with access to the feature, the impact is limited to users with such privileges. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the qcuiknote feature to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing this feature to untrusted or external users.