Loading story…
A disclosed flaw in AppFlowy, tracked as CVE-2026-16007, allows an authenticated user to perform SQL injection through the search_term parameter in the /api/workspace/{workspace-id}/quick-note endpoint. The issue affects the quick-note search functionality and was traced to libs/database/src/quick_note.rs, creating a path for database exfiltration, modification, or deletion by any user with valid access.
The disclosure said AppFlowy indicated the issue no longer applied to its commercial AppFlowy Cloud codebase, but it did not confirm a fix or publish a remediation plan for the open-source, self-hosted version. Discussion on r/netsec amplified concerns that the SaaS offering had been addressed while community deployments remained vulnerable, leaving self-hosted administrators without clear patch guidance or assurance that the flaw had been resolved.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
The researchers informed AppFlowy that they intended to proceed with public disclosure of the SQL injection issue.
Project Black asked AppFlowy whether it intended to patch the open-source version after the vendor said the issue no longer affected its commercial cloud offering.
AppFlowy replied that the issue no longer applied to its commercial AppFlowy Cloud codebase. The response did not confirm a fix or address the open-source/self-hosted version.
Project Black contacted AppFlowy again because no further update had been provided on the vulnerability report.
AppFlowy responded to the researchers and said it was investigating the reported SQL injection vulnerability.
After receiving no response to the initial report, the researchers sent a follow-up to AppFlowy regarding the SQL injection issue.
Project Black reported an authenticated SQL injection vulnerability in AppFlowy, later tracked as CVE-2026-16007, to the vendor. The flaw affected the quick-note search functionality and could allow an authenticated user to exfiltrate, modify, or delete database contents.
Project Black published technical details for CVE-2026-16007, describing an authenticated SQL injection in AppFlowy's quick-note search endpoint and providing a proof-of-concept payload. The disclosure also highlighted uncertainty around remediation for the open-source/self-hosted version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **elttam** disclosed **six remote code execution vulnerabilities** in the **Flowise** AI agent and workflow platform, affecting versions **3.1.1** and **3.1.2**. The flaws could allow attackers to execute code on exposed Flowise servers, raising concerns for organizations using the platform to orchestrate AI workflows and integrations. Reporting on the issue also referenced Flowise-related local and container paths and endpoints tied to authentication, document processing, and custom function handling, including sensitive files such as `/proc/self/environ` and `/root/.flowise/database.sqlite`. Those details suggest attackers could pursue local file access and post-exploitation activity after initial compromise, adding to concerns around Flowise's recurring history of critical security advisories.
Sep 3, 2026
A critical insecure direct object reference flaw, tracked as **`CVE-2026-67622`**, affects **Flowise through version 3.1.4** and allows authenticated users to access resources tied to other workspaces in multi-tenant deployments. The bug resides in the **OpenAI Assistants integration**, where assistants-related endpoints accept an arbitrary credential UUID and resolve it without verifying that the credential belongs to the caller’s active workspace. The vulnerability is classified as **`CWE-639`** and has been rated **CVSS 9.9** under v3.1, with reporting also citing a **CVSS 4.0 score of 8.5**. By supplying another workspace’s credential UUID, an attacker can cause Flowise to use a victim workspace’s OpenAI Assistants credential, enabling cross-workspace access to assistant metadata, file listings, and vector stores, and allowing file uploads into victim workspaces. The flaw also creates a path to unauthorized OpenAI API consumption and potential billing impact on affected accounts. Public reporting said no active exploitation had been observed at publication, and a vendor fix was expected in a future Flowise release.
Aug 10, 2026
A high-severity SQL injection vulnerability, tracked as **`CVE-2026-69085`**, affects **SiYuan before `v3.7.3`** in the `/api/filetree/searchDocs` endpoint. The flaw stems from the `keyword` parameter being concatenated directly into SQL queries without escaping or parameter binding, enabling attackers to inject arbitrary SQL through network access with low complexity and no user interaction. The vulnerable endpoint is reachable with a publish `RoleReader` token and, in some deployments, **without authentication** when publish mode is enabled and `Publish.Auth.Enable` is set to `false`. Because the injected SQL runs on a **read-write SQLite** connection that supports stacked statements, attackers can **read and modify database contents** across all cleartext, non-encrypted notebooks on the affected instance. The issue is classified as **CWE-89** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`.
Aug 3, 2026