CVE-2026-88898

Name of the Vulnerable Software and Affected Versions AppFlowy-Cloud versions 0.7.2 through 0.9.64

Description Authenticated users can publish content into other tenants' namespaces because the system fails to authorize callers against the workspace in the bulk publish endpoint path. This allows attackers to write published views with controlled title, body, and metadata into victim workspaces, which can be used to deface public pages or host phishing content on trusted URLs.

Recommendations Update AppFlowy-Cloud to a version later than 0.9.64.