CVE-2026-77169
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
- Published Sep 18, 2026
- CVSS 6.5 medium
- 0.5% chance of exploitation in the next 30 days (EPSS)