HIGH

CVE-2026-92788

2026-09-16 CVSS v3.1

CVSS

8.8

Description

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.28%

Probability of exploitation in next 30 days

21.1th percentile

References

https://github.com/coze-dev/coze-studio https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/memory/database/service/database_impl.go#L2203-L2250 https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/infra/rdb/impl/rdb/mysql.go#L825-L830 https://github.com/coze-dev/coze-studio/issues/2710 https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-tenant-database-access-via-workflow-sql-node

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE