API Security

Everything Firewall Chronicle has reported about API Security: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Coze Studio IDOR CVE-2026-77935 Enables Cross-Tenant Workflow Manipulation Up to v0.5.1

An insecure direct object reference in Coze Studio through 0.5.1 allows authenticated users to access and manipulate workflows belonging to other tenants.

Oct 20, 2026

Vulnerabilities

Broken Object Level Authorization Prevention Checklist for APIs

Most API breaches occur because servers verify user identity but forget to verify object ownership, leaving data exposed to anyone with a predictable ID.

Oct 15, 2026