Evidence · DiggingBeagle record
Coze CVE-2026-77935 workflow authorization advisory
- Source role
- primary disclosure
Evidence record
Claim-level citations (1)
- supportsCoze checks space membership without binding the requested workflow to that space: CVE-2026-77935 reports that authenticated users can combine their own spaceID with another space's workflowID in handlers that check membership but omit workflow ownership.
Root Cause and PoC; workflow.go handlers and affected operations