CVE-2026-77935

8.3High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.3High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-639

Impact

Authenticated attackers can read, modify, execute, or delete workflows belonging to other tenants. They only need a valid user account with network access to the API.

Root cause

An insecure direct object reference (IDOR) in workflow.go fails to verify that the requested workflowID actually belongs to the user's spaceID.

Affected systems

Coze Studio through 0.5.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fix & remediation

Upgrade to a version newer than 0.5.1 once released; if patching must wait, block or inspect traffic to the workflow endpoints (save, update_meta, batch_delete, canvas, test_run, nodeDebug) via reverse proxy to restrict cross-space requests.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77935