CVE-2026-77935

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77935
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77935.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-77935
Published
2026-10-20T00:46:13Z
Modified
2026-10-20T10:47:24Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Details

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77935.json"
}
References

Affected packages

Git / github.com/coze-dev/coze-studio

Affected ranges

Type
GIT
Repo
https://github.com/coze-dev/coze-studio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
72cecff858a5a18662c5d9d1a4764c53ebc98317
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*
v0.1.1
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.5
v0.3.0
v0.5.0
v0.5.0-beta
v0.5.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77935.json"