CVE-2026-92788: Coze Studio SQL Injection Vulnerability

CVE-2026-92788 Overview

Coze Studio through version 0.5.1 contains a broken access control flaw in workflow SQL customization nodes. The application fails to validate that table names referenced in SQL nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against memory databases owned by other workspaces. This enables cross-tenant reads, inserts, and deletions of arbitrary data. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users in one workspace can read, modify, or delete data stored in memory databases belonging to other tenants, breaking multi-tenant isolation.

Affected Products

Coze Studio versions through 0.5.1
backend/domain/memory/database/service/database_impl.go component
backend/infra/rdb/impl/rdb/mysql.go MySQL implementation

Discovery Timeline

2026-09-16 - CVE-2026-92788 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92788

Vulnerability Analysis

Coze Studio exposes workflow nodes that let users author custom SQL against workspace-scoped memory databases. The SQL execution path accepts a table identifier from the caller and forwards it to the underlying relational database (RDB) layer without verifying that the referenced table belongs to the caller's workspace. Because table identifiers follow predictable naming patterns, an authenticated user can enumerate identifiers assigned to other workspaces and target them directly. Once the workspace check is bypassed, the SQL layer executes the statement with the same privileges used for legitimate customization queries. The result is a cross-tenant break in isolation that permits reading, inserting, and deleting rows in other tenants' databases. See the VulnCheck advisory for Coze Studio for a full description.

Root Cause

The root cause is missing authorization on tenant-scoped resources. The database service in database_impl.go resolves the target table by identifier but does not confirm ownership against the caller's workspace before dispatching to the RDB layer. This is a classic CWE-863 failure where authentication is enforced but authorization on the referenced object is not.

Attack Vector

Exploitation requires only low-privileged authenticated access to the Coze Studio API and network reachability to the application. An attacker creates or edits a workflow, adds a SQL customization node, and supplies a table identifier belonging to another workspace. Because identifiers are predictable, they can be enumerated programmatically. The vulnerability manifests in the workflow SQL execution path; refer to the GitHub code reference and MySQL implementation for technical details.

Detection Methods for CVE-2026-92788

Indicators of Compromise

Workflow SQL nodes referencing table identifiers that do not map to the invoking workspace
Sequential or brute-forced enumeration of memory database table identifiers by a single user
Unexpected INSERT, UPDATE, or DELETE operations against memory database tables outside the requesting workspace

Detection Strategies

Audit workflow execution logs for SQL statements whose target table's owning workspace does not match the caller's workspace
Correlate API access logs with database query logs to identify cross-workspace resource references
Flag any workflow SQL node that queries information_schema or performs table discovery beyond the caller's scope

Monitoring Recommendations

Enable verbose logging on the database_impl.go service path and stream logs to a centralized SIEM
Alert on high-volume table identifier lookups originating from a single authenticated principal
Monitor GitHub issue #2710 and the Coze Studio repository for patch releases and updated guidance

How to Mitigate CVE-2026-92788

Immediate Actions Required

Restrict access to the Coze Studio workflow SQL customization node to trusted operators only
Rotate or invalidate any sensitive data stored in shared memory databases that may have been exposed
Review workflow execution history for cross-workspace table references and revoke suspect accounts

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track the Coze Studio repository and issue #2710 for a patched release, and consult the VulnCheck advisory for remediation updates.

Workarounds

Disable the workflow SQL customization node feature for non-administrative users until a patch is available
Enforce workspace ownership validation in an upstream reverse proxy or API gateway by inspecting the table identifier parameter
Segment tenants by deploying isolated Coze Studio instances per customer when strong multi-tenant isolation is required

bash

# Example: block workflow SQL node endpoints at an upstream proxy
# until an authorized fix is deployed
location ~ ^/api/workflow/.*/sql {
    deny all;
    return 403;
}