{"id":"CVE-2026-77935","kind":"vulnerability","aliases":["CVE-2026-77935"],"related":[],"title":"Coze Studio: authenticated users read and alter other tenants' workflows","description":"Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.","summary":"Coze Studio through 0.5.1 checks only that the caller belongs to the spaceID in a request, not that the workflowID belongs to that space. Any logged-in user can pass their own spaceID with another tenant's workflowID to read, test-run, overwrite or delete that workflow. Affected routes: save, update_meta, batch_delete, canvas, test_run and nodeDebug. This applies in every deployment configuration. No fixed release has been published.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"coze-studio","fixed":[],"affected":"<= 0.5.1","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","coze-studio","multi-tenant","self-hosted"],"not_affected_if":["no-untrusted-accounts","registration-closed","single-tenant","single-tenant-deployment"],"how_to_check":"Run a self-hosted Coze Studio at 0.5.1 or earlier (check the image tag, e.g. cozedev/coze-studio-server:0.5.1) with more than one space or tenant, and you are exposed. Upstream's latest release is 0.5.1, so every release is affected.","fix":"No patched release is known; v0.5.1 is the newest and is vulnerable. Until upstream ships one, limit registration so only trusted users have accounts, keep it off the public internet or behind an authenticating proxy, and watch coze-dev/coze-studio for a release. The fix per Lasso is a check after checkUserSpace that the workflow's SpaceID equals the authorized space, as already done in the OpenAPI WorkflowRun path (workflow.go:1551-1565).","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:37:25+00:00","updated_at":"2026-10-23T22:38:33+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:37:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Coze Studio: authenticated users read and alter other tenants' workflows","impact":"high","summary":"Coze Studio through 0.5.1 lets any logged-in user pair their own space ID with another tenant's workflow ID. An attacker can then read, run, overwrite or delete that tenant's workflows through several workflow routes.","category":"ai-tooling","who_cares":["coze-studio","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"other tenants' workflows read, run, overwritten or deleted by any account","analyst_note":"Find the fixed release after 0.5.1 and the patched workflow.go check in the Coze Studio repository or advisory; the sources give no version to move to.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-tenant-deployment","no-untrusted-accounts"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2950,"output_tokens":360,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed release after 0.5.1 and the patched workflow.go check in the Coze Studio repository or advisory; the sources give no version to move to.","search":"'-2026':12A,15A '-77935':13A,16A '0.5.1':35B,108C 'access':123C 'affect':81B 'ai':21B 'ai-tool':20B 'allow':119C 'alter':7A 'anoth':67B,138C 'appli':94B 'attack':131C 'authent':3A,120C 'batch':86B,146C 'belong':41B,52B 'caller':40B 'canva':88B,148C 'check':36B 'configur':98B 'contain':109C 'coze':1A,18A,24B,32B,105C 'coze-studio':17A,23B 'cve':11A,14A 'delet':78B,87B,147C,159C 'deploy':97B 'direct':112C 'everi':96B 'fix':100B 'foreign':129C 'host':31B 'insecur':111C 'log':58B 'logged-in':57B 'meta':85B,145C 'multi':27B 'multi-ten':26B 'nodedebug':92B,152C 'object':113C 'overwrit':76B,157C 'pair':133C 'pass':62B 'publish':104B 'read':5A,72B,155C 'refer':114C 'releas':101B 'request':47B 'rout':82B,153C 'run':75B,90B,150C,156C 'save':83B,143C 'self':30B 'self-host':29B 'space':55B,125C 'spaceid':44B,65B,136C 'studio':2A,19A,25B,33B,106C 'suppli':128C 'tenant':9A,28B,68B,139C 'test':74B,89B,149C 'test-run':73B 'tool':22B 'updat':84B,144C 'user':4A,60B,121C 'vulner':115C 'workflow':10A,80B,126C,160C 'workflow.go':117C 'workflowid':51B,70B,130C,141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77935","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77935:265","url":null,"severity":null,"published_at":"2026-10-23T22:38:33+00:00","modified_at":"2026-10-23T22:38:33+00:00","first_seen_at":"2026-10-23T22:38:33+00:00","fetched_at":"2026-10-23T22:38:33+00:00","note":"Read Lasso (finder) and VulnCheck advisories plus coze-studio releases page: no fixed release exists; latest is v0.5.1 (Feb 2026), which is the affected one. No vendor advisory or fix commit found. Lasso says no known exploit, PoC is described in prose (POST /api/workflow/testrun with own spaceID and foreign workflowID). Did not search social."}],"documents":[{"id":1542,"url":"https://www.lasso.security/vulnerability-database/cve-2026-77935","title":"Lasso: CVE-2026-77935 Cross-Space Workflow IDOR","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1544,"url":"https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-space-workflow-idor-via-workflow-api-handlers","title":"VulnCheck advisory CVE-2026-77935","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1509,"url":"https://github.com/coze-dev/coze-studio/releases","title":"coze-studio releases (latest v0.5.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}