---
id: CVE-2026-77935
title: Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
summary: >-
  Coze Studio through 0.5.1 contains an insecure direct object reference
  vulnerability in workflow.go that allows authenticated users to access other
  spaces' workflows by supplying foreign workflowIDs. Attackers can pair their
  own spaceID …
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: coze-dev
product: coze-studio
affected:
  - coze-studio <= 0.5.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T00:46:13.474Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77935'
references:
  - url: 'https://www.lasso.security/vulnerability-database/cve-2026-77935'
    label: Lasso.security Advisory
  - url: >-
      https://github.com/coze-dev/coze-studio/blob/72cecff858a5a18662c5d9d1a4764c53ebc98317/backend/application/workflow/workflow.go#L303
  - url: >-
      https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-space-workflow-idor-via-workflow-api-handlers
    label: >-
      VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Space Workflow IDOR
      via Workflow API Handlers
tags:
  - cve.org
ingestedAt: '2026-10-20T01:49:42.624Z'
---

## Overview

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

## Affected

- `coze-studio <= 0.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.