CVE-2026-85622: Incorrect Authorization in AppFlowy-IO AppFlowy-Cloud

CVE-2026-85622 describes an incorrect authorization vulnerability in AppFlowy-Cloud up to version 0.9.64. The vulnerability exists in the establish_ws_connection_v2 handler, where the application does not properly validate whether an authenticated user is a member of the workspace they attempt to connect to via WebSocket. Exploiting this flaw, an attacker can bind sessions to unauthorized workspaces and send sync Manifest messages containing victim object identifiers, enabling them to read the full document or database state from collaborations in those other workspaces without the victim's involvement.

An attacker with authenticated access can bypass workspace membership checks to access sensitive data from other workspaces. This leads to unauthorized disclosure of full document or database states from collaborative environments, potentially exposing confidential information across workspace boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and apply patches once available.