Coze checks space membership without binding the requested workflow to that space

CLM-COZE-WORKFLOW-OWNERSHIP reports: CVE-2026-77935 reports that authenticated users can combine their own spaceID with another space's workflowID in handlers that check membership but omit workflow ownership. Source SRC-2026-RADAR-COZE-WORKFLOW-OWNERSHIP is located at 'Root Cause and PoC; workflow.go handlers and affected operations'. The distinctive mechanism begins: Coze Studio workflow handlers checked the requesting user's membership in the supplied spaceID but did not verify that the separately supplied workflowID belonged to that space. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: After space membership succeeds, fetch the target workflow and check its authoritative owner/space against the authenticated principal before every read, debug or mutation. Hiding a workflow ID in the UI cannot replace server-side binding. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-COZE-WORKFLOW-OWNERSHIP · Coze CVE-2026-77935 workflow authorization advisory