Live › vulnerability › CVE-2026-77935
Go to dashboardCoze Studio through 0.5.1 checks only that the caller belongs to the spaceID in a request, not that the workflowID belongs to that space. Any logged-in user can pass their own spaceID with another tenant's workflowID to read, test-run, overwrite or delete that workflow. Affected routes: save, update_meta, batch_delete, canvas, test_run and nodeDebug. This applies in every deployment configuration. No fixed release has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| coze-studio | github | <= 0.5.1 | – |
0.5.1 or earlier (check the image tag, e.g. cozedev/coze-studio-server:0.5.1) with more than one space or tenant, and you are exposed0.5.1, so every release is affectedv0.5.1 is the newest and is vulnerableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
This page as .md · .json · in your agent: get_signal("CVE-2026-77935")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.