Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-16007

Authenticated SQL Injection in AppFlowy

Description

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AppFlowy-IO AppFlowy-Cloud

Default version status: affected

  • 0 to ≤ *affected

References