---
id: 6553
title: "[CVE-2026-16007] AppFlowy Authenticated SQL Injection"
cve: CVE-2026-16007
vendor: "AppFlowy"
product: "AppFlowy"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/appflowy-authenticated-sql-injection/"
published_at: "2026-08-15T05:06:09Z"
tags: ["sql-injection", "web-security", "vulnerability", "disclosure", "appflowy", "cve-2026-16007"]
phying_url: "https://phying.com/item/6553"
lang: en
---

# [CVE-2026-16007] AppFlowy Authenticated SQL Injection

## Summary

Project Black details CVE-2026-16007, an authenticated SQL injection in AppFlowy: the quick-note search parameter reaches the SQL query unsanitized—plus a telling vendor response.

## Why it matters

This vulnerability coverage helps defenders validate exposure and prioritize remediation.

## Intelligence Metadata

- **Sources:** projectblack.io
- **CVE:** CVE-2026-16007
- **Vendor:** AppFlowy
- **Product:** AppFlowy
- **Published:** 2026-08-15T05:06:09Z
- **Original:** https://projectblack.io/blog/appflowy-authenticated-sql-injection/
- **Phying News:** https://phying.com/item/6553