Insecure Direct Object Reference in Coze Studio workflow.go

Coze Studio versions up to and including 0.5.1 contain an Insecure Direct Object Reference (IDOR) vulnerability within the workflow.go component. This vulnerability stems from insufficient access control checks when processing workflow identifiers. An authenticated user can supply foreign workflowIDs associated with another tenant while pairing them with their own spaceID.

By manipulating parameters in specific API routes, including save, update_meta, batch_delete, canvas, test_run, and nodeDebug, an attacker can read, execute, overwrite, or delete workflows belonging to other spaces. Because the application fails to validate that the requested workflowID resides within the context of the user's authorized spaceID, the integrity and confidentiality of cross-tenant workflows are compromised. This impact is significant as it allows for the manipulation of workflows across the entire multi-tenant environment.

Impact

The vulnerability allows unauthorized authenticated users to compromise the workflows of other tenants. Success leads to data exfiltration, unauthorized execution of automation logic, modification of business processes, or permanent deletion of workflows. This impacts the integrity and availability of services for any organization hosting workflows on a shared or multi-tenant Coze Studio instance.

Recommendation

• Upgrade Coze Studio to a patched version beyond 0.5.1 as soon as it becomes available.
• Implement strict request validation at the application firewall level for all API routes involving workflowID and spaceID parameters.
• Audit access logs for instances where a single authenticated user session interacts with multiple distinct spaceIDs.
• Patch CVE-2026-77935 immediately upon release of the vendor security update.