CVE-2026-16007: Appflowy-Io Appflowy-Cloud

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Affected products

• Appflowy-Io Appflowy-Cloud: any version

Published 2026-08-15. Last modified 2026-09-09.