CVE-2026-16007

HighCVSS 7.1

Published: 15/08/2026(UTC)Updated: 09/09/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Risk Assessment

Risk of sensitive data exfiltration from the database by an authenticated user.

Recommendation

Update AppFlowy to a patched version and restrict access to the qcuiknote feature.

Other vulnerabilities in AppFlowy

CVE-2026-52097Medium
An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components.

Original NVD description (English source)

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS