[Security] Privilege Escalation Vulnerability – Request for Private Disclosure Channel

[A8r00t]

Hello AppFlowy Security Team,

I hope you are doing well.

I discovered a serious security vulnerability in AppFlowy involving broken access control and unintended privilege escalation. The issue allows a regular member to escalate their role to “owner” by modifying the role value in the request, leading to full workspace takeover privileges (including destructive actions such as workspace deletion).

To follow responsible disclosure best practices, I would like to share the technical details, reproduction steps, and proof of exploitation privately.

Please provide a secure communication channel (such as a security email or a private issue thread) so I can submit the full report safely.

Thank you for your time, and I look forward to your response.

[Vivian-appflowy]

Hi, thanks for letting us know! You can contact the email: [email protected]