CVE-2026-77935— Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Quick assessment
Affected
coze-dev coze-studio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Coze Studio 0.5.1 及更早版本在 中存在不安全的直接对象引用（IDOR）漏洞。该漏洞允许已认证用户通过提供其他租户的工作流 ID（workflowID），访问其他空间（space）中的工作流。攻击者可以将自己的空间 ID（spaceID）与其他租户的工作流 ID 组合，利用 、 、 、 、 和 等路由，实现对工作流的读取、执行、覆盖或删除操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77935
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Source: CVE Program / CVE List V5
Vulnerability Description
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coze-dev | coze-studio | 0 ~ 0.5.1 | - |
|
II. Public POCs for CVE-2026-77935
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77935
请登录查看更多情报信息。
Other References for CVE-2026-77935 (2)
IV. Related Vulnerabilities
Same product: coze-studio
-
CVE-2026-77934
Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Co -
CVE-2026-92795
Coze Studio through 0.5.1 Server-Side Request Forgery via Pl -
CVE-2026-92788
Coze Studio through 0.5.1 Cross-Tenant Database Access via W -
CVE-2026-7023
ByteDance coze-studio databaseTool database_impl.go ExecuteS -
CVE-2025-9604
coze-studio aes.go hard-coded key
Same weakness: CWE-639
-
CVE-2026-77937
Letta through 0.16.8 Cross-Tenant Impersonation via user_id -
CVE-2026-107366
Langflow OSS Authorization Bypass Through User-Controlled Ke -
CVE-2026-112294
FlyCms through commit edfdf724 Missing Authorization via Act -
CVE-2026-112287
Krayin CRM before 2.2.7 Broken Object Level Authorization in -
CVE-2026-112286
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Produ
V. Comments for CVE-2026-77935
No comments yet