---
id: "CVE-2026-77935"
kind: "vulnerability"
aliases: ["CVE-2026-77935"]
title: "Coze Studio: authenticated users read and alter other tenants' workflows"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "coze-studio", "fixed": [], "affected": "<= 0.5.1", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "coze-studio", "multi-tenant", "self-hosted"]
not_affected_if: ["no-untrusted-accounts", "registration-closed", "single-tenant", "single-tenant-deployment"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:38:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77935", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:38:33+00:00"}]
---

# Coze Studio: authenticated users read and alter other tenants' workflows

Coze Studio through 0.5.1 checks only that the caller belongs to the spaceID in a request, not that the workflowID belongs to that space. Any logged-in user can pass their own spaceID with another tenant's workflowID to read, test-run, overwrite or delete that workflow. Affected routes: save, update_meta, batch_delete, canvas, test_run and nodeDebug. This applies in every deployment configuration. No fixed release has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:coze-studio affected <= 0.5.1 fixed ?

## How to check

Run a self-hosted Coze Studio at 0.5.1 or earlier (check the image tag, e.g. cozedev/coze-studio-server:0.5.1) with more than one space or tenant, and you are exposed. Upstream's latest release is 0.5.1, so every release is affected.

## Fix

No patched release is known; v0.5.1 is the newest and is vulnerable. Until upstream ships one, limit registration so only trusted users have accounts, keep it off the public internet or behind an authenticating proxy, and watch coze-dev/coze-studio for a release. The fix per Lasso is a check after checkUserSpace that the workflow's SpaceID equals the authorized space, as already done in the OpenAPI WorkflowRun path (workflow.go:1551-1565).

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77935
- 2026-10-23T22:38:33+00:00 analyst — Read Lasso (finder) and VulnCheck advisories plus coze-studio releases page: no fixed release exists; latest is v0.5.1 (Feb 2026), which is the affected one. No vendor advisory or fix commit found. Lasso says no known exploit, PoC is described in prose (POST /api/workflow/testrun with own spaceID and foreign workflowID). Did not search social.

## Documents

- [advisory] Lasso: CVE-2026-77935 Cross-Space Workflow IDOR https://www.lasso.security/vulnerability-database/cve-2026-77935
- [advisory] VulnCheck advisory CVE-2026-77935 https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-space-workflow-idor-via-workflow-api-handlers
- [mentions] coze-studio releases (latest v0.5.1) https://github.com/coze-dev/coze-studio/releases

## From the sources

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_