CVE-2026-77935highCWE-639

CVE-2026-77935: high-severity vulnerability in coze-dev coze-studio

Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers

Published

Follow this CVE+ Monitor coze-studio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.7epss 0.4%
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
coze-dev · coze-studio
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — coze-dev coze-studio

In the same product, most dangerous first.

CVE-2026-77934HIGHCoze Studio before 0.5.0 RCE via Unsandboxed Local Python Code RunnerEPSS 0.7%CVE-2026-92788HIGHCoze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL NodeEPSS 0.5%CVE-2026-92795HIGHCoze Studio through 0.5.1 Server-Side Request Forgery via PluginEPSS 0.4%