[GH-ISSUE #8349] [Security] Privilege Escalation Vulnerability – Request for Private Disclosure Channel #3752

New issue

Closed

opened 2026-03-23 21:32:54 +00:00 by mirror · 1 comment

mirror commented

2026-03-23 21:32:54 +00:00

Owner

Originally created by @A8r00t on GitHub (Nov 19, 2025).
Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/8349

Hello AppFlowy Security Team,

I hope you are doing well.

I discovered a serious security vulnerability in AppFlowy involving broken access control and unintended privilege escalation.
The issue allows a regular member to escalate their role to “owner” by modifying the role value in the request, leading to full workspace takeover privileges (including destructive actions such as workspace deletion).

To follow responsible disclosure best practices, I would like to share the technical details, reproduction steps, and proof of exploitation privately.

Please provide a secure communication channel (such as a security email or a private issue thread) so I can submit the full report safely.

Thank you for your time, and I look forward to your response.

Originally created by @A8r00t on GitHub (Nov 19, 2025). Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/8349 Hello AppFlowy Security Team, I hope you are doing well. I discovered a serious security vulnerability in AppFlowy involving broken access control and unintended privilege escalation. The issue allows a regular member to escalate their role to “owner” by modifying the role value in the request, leading to full workspace takeover privileges (including destructive actions such as workspace deletion). To follow responsible disclosure best practices, I would like to share the technical details, reproduction steps, and proof of exploitation privately. Please provide a secure communication channel (such as a security email or a private issue thread) so I can submit the full report safely. Thank you for your time, and I look forward to your response.

mirror closed this issue

2026-03-23 21:32:55 +00:00

mirror commented

2026-03-23 21:32:55 +00:00

Author

Owner

@Vivian-appflowy commented on GitHub (Nov 20, 2025):

Hi, thanks for letting us know! You can contact the email: support@appflowy.io

@Vivian-appflowy commented on GitHub (Nov 20, 2025): Hi, thanks for letting us know! You can contact the email: [support@appflowy.io](mailto:support@appflowy.io)

mirror referenced this issue

2026-03-23 22:20:38 +00:00

[PR #3752] [MERGED] feat: allow hiding ungrouped stack #5862