CVE Catalog
CVE-2026-16007
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.20%
11th percentile - higher than 11% of all known CVEs
Summary
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.
Risk Assessment
Risk of sensitive data exfiltration from the database by an authenticated user.
Recommendation
Update AppFlowy to a patched version and restrict access to the qcuiknote feature.
Original NVD description (English source)
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.