CVE-2026-77935 Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-77935?
CVE-2026-77935 is a high-severity vulnerability in coze-dev coze-studio, published on 20 Oct 2026.
Official description
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
Weakness: CWE-639
Which versions are affected by CVE-2026-77935?
How do I fix CVE-2026-77935?
No fix has been published for CVE-2026-77935 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77935 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77935 exists.
Sources
Also known as GHSA-w9wj-jq72-68p2.