GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by coze-dev

    CVE-2026-92795 (GCVE-0-2026-92795)

    Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
    VLAI
    Title
    Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
    Summary
    Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    coze-dev coze-studio Affected: 0 , ≤ 0.5.1 (semver)
        cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-07-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "coze-studio",
          "vendor": "coze-dev",
          "versions": [
            {
              "lessThanOrEqual": "0.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:49.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2711",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/coze-dev/coze-studio/issues/2711"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/coze-dev/coze-studio"
        },
        {
          "name": "the outbound request is built from the stored plugin URL with no address restriction",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/plugin/service/tool/invocation_http.go#L127-L146"
        },
        {
          "name": "VulnCheck Advisory: Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-server-side-request-forgery-via-plugin"
        }
      ],
      "title": "Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92795",
    "datePublished": "2026-09-16T20:32:49.712Z",
    "dateReserved": "2026-09-16T19:40:20.905Z",
    "dateUpdated": "2026-09-16T20:32:49.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92788 (GCVE-0-2026-92788)

    Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
    VLAI
    Title
    Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
    Summary
    Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    coze-dev coze-studio Affected: 0 , ≤ 0.5.1 (semver)
        cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-07-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "coze-studio",
          "vendor": "coze-dev",
          "versions": [
            {
              "lessThanOrEqual": "0.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller\u0027s workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces\u0027 memory databases to read, insert, or delete data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:44.626Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2710",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/coze-dev/coze-studio/issues/2710"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/coze-dev/coze-studio"
        },
        {
          "name": "only the shape of the table name is validated, not its ownership",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/memory/database/service/database_impl.go#L2203-L2250"
        },
        {
          "name": "physical table names are table_\u003cid\u003e from an install-wide generator",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/infra/rdb/impl/rdb/mysql.go#L825-L830"
        },
        {
          "name": "VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-tenant-database-access-via-workflow-sql-node"
        }
      ],
      "title": "Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92788",
    "datePublished": "2026-09-16T20:32:44.626Z",
    "dateReserved": "2026-09-16T19:31:52.771Z",
    "dateUpdated": "2026-09-16T20:32:44.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92795 (GCVE-0-2026-92795)

    Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
    VLAI
    Title
    Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
    Summary
    Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    coze-dev coze-studio Affected: 0 , ≤ 0.5.1 (semver)
        cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-07-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "coze-studio",
          "vendor": "coze-dev",
          "versions": [
            {
              "lessThanOrEqual": "0.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:49.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2711",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/coze-dev/coze-studio/issues/2711"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/coze-dev/coze-studio"
        },
        {
          "name": "the outbound request is built from the stored plugin URL with no address restriction",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/plugin/service/tool/invocation_http.go#L127-L146"
        },
        {
          "name": "VulnCheck Advisory: Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-server-side-request-forgery-via-plugin"
        }
      ],
      "title": "Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92795",
    "datePublished": "2026-09-16T20:32:49.712Z",
    "dateReserved": "2026-09-16T19:40:20.905Z",
    "dateUpdated": "2026-09-16T20:32:49.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92788 (GCVE-0-2026-92788)

    Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
    VLAI
    Title
    Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
    Summary
    Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    coze-dev coze-studio Affected: 0 , ≤ 0.5.1 (semver)
        cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-07-06 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "coze-studio",
          "vendor": "coze-dev",
          "versions": [
            {
              "lessThanOrEqual": "0.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller\u0027s workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces\u0027 memory databases to read, insert, or delete data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:44.626Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2710",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/coze-dev/coze-studio/issues/2710"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/coze-dev/coze-studio"
        },
        {
          "name": "only the shape of the table name is validated, not its ownership",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/memory/database/service/database_impl.go#L2203-L2250"
        },
        {
          "name": "physical table names are table_\u003cid\u003e from an install-wide generator",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/infra/rdb/impl/rdb/mysql.go#L825-L830"
        },
        {
          "name": "VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-tenant-database-access-via-workflow-sql-node"
        }
      ],
      "title": "Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92788",
    "datePublished": "2026-09-16T20:32:44.626Z",
    "dateReserved": "2026-09-16T19:31:52.771Z",
    "dateUpdated": "2026-09-16T20:32:44.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}