Coze Studio IDOR CVE-2026-77935 Enables Cross-Tenant Workflow Manipulation Up to v0.5.1

Coze Studio through version 0.5.1 contains a high-severity insecure direct object reference vulnerability. According to the National Vulnerability Database, this flaw allows authenticated users to access workflows belonging to other spaces by supplying foreign identifiers.

What happened

The National Vulnerability Database records CVE-2026-77935 as a high-severity issue with a CVSS score of 8.7. The weakness is classified under CWE-639 and exists within the workflow.go component of Coze Studio. It affects all versions of the software up to and including 0.5.1.

Authenticated users can exploit this vulnerability by pairing their own spaceID with a workflowID belonging to another tenant. This manipulation works across several API routes, including save, update_meta, batch_delete, canvas, test_run, and nodeDebug. By leveraging these endpoints, an attacker can read, execute, overwrite, or delete workflows that do not belong to them.

Why it matters

This vulnerability exposes multi-tenant environments to significant data integrity and confidentiality risks. Because the flaw relies on insecure direct object references, it bypasses standard authorization checks that should restrict access to specific workspace boundaries.

Security operations teams must recognize that authenticated credentials are sufficient for exploitation. This means insider threats or compromised accounts can laterally move between tenant spaces. The ability to delete or overwrite workflows could disrupt critical automation processes hosted within the platform.

What to watch

• Monitor for unusual cross-tenant API calls in workflow management logs.
• Check for unexpected changes to workflow metadata or deletion events.
• Look for test runs initiated by users outside the workflow owner's space.
• Alert on rapid sequences of save and update operations from single accounts.

Signals worth monitoring

Teams usually detect this activity by reviewing API access logs for anomalies in parameter values. Check whether workflow IDs in request payloads match the authenticated user's assigned space. Look for alerts triggered by unauthorized modification or execution events. Verify that batch delete operations align with expected administrative actions.

Investigate any canvas or test run requests that originate from accounts lacking ownership rights. Review authentication tokens to ensure they are not being reused across different tenant contexts. Analyze traffic patterns for high-frequency calls to sensitive endpoints like nodeDebug. Ensure logging captures both the source space and the target workflow identifier for every transaction.

Background: Insecure direct object references (IDOR)

Insecure direct object references occur when an application exposes internal object identifiers in requests. An attacker changes these identifiers to access records belonging to other users. The fix requires server-side validation that the requester owns the target resource.

Read the full guide: Insecure Direct Object References: How Hidden IDs Leak Data

What to do and how to stay safe: Coze Studio

• Audit current Coze Studio installations to confirm if version 0.5.1 or earlier is deployed.
• Review API logs for instances where users accessed workflow IDs outside their assigned space.
• Restrict network access to the Coze Studio API endpoints to trusted internal networks only.
• Prepare to apply vendor updates once the provider releases a patched version of the software.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Coze Studio are affected by this vulnerability?

Coze Studio versions up to and including 0.5.1 are affected by CVE-2026-77935.

What is the severity rating of this flaw?

The National Vulnerability Database rates CVE-2026-77935 as HIGH with a CVSS score of 8.7.

Can unauthenticated users exploit this vulnerability?

No, the source material states that authenticated users are required to exploit this flaw.