CVE-2026-92788 | BDVDB-2026-375501 Detail
coze-devcoze-studio
Description#
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-863 Incorrect Authorization
References#
- https://github.com/coze-dev/coze-studio/issues/2710
- https://github.com/coze-dev/coze-studio
- https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/memory/database/service/database_impl.go#L2203-L2250
- https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/infra/rdb/impl/rdb/mysql.go#L825-L830
- https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-tenant-database-access-via-workflow-sql-node
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.